{"id":"CVE-2026-77596","kind":"vulnerability","aliases":["CVE-2026-77596"],"related":[],"title":"Kubeflow Pipelines: missing namespace check lets tenants upload shared pipelines","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.","summary":"Kubeflow Pipelines skips its write-permission check on pipeline upload when no namespace is given, which is the default. A low-privilege tenant, or an unauthenticated caller if the API server is reachable without an authenticating proxy, can create shared pipelines or inject versions that later run under another tenant's service account.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubeflow","kubernetes","machine-learning","multi-tenant","package"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the Kubeflow Pipelines version the deployment runs; affected versions are those before `2.18.0`.\n- Check whether `REQUIRE_NAMESPACE_FOR_PIPELINES` is set to true; it defaults to false.\n- Check whether the API server is reachable without an authenticating proxy in front of it.","fix":"- Kubeflow Pipelines: move to `2.18.0`.","status":"open","published_at":"2026-11-05T23:17:00+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:32+00:00","updated_at":"2026-11-05T23:49:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T23:49:32Z","model":"claude-haiku-5-5","output":{"fix":"- Kubeflow Pipelines: move to `2.18.0`.","reach":"network","title":"Kubeflow Pipelines: missing namespace check lets tenants upload shared pipelines","impact":"high","summary":"Kubeflow Pipelines skips its write-permission check on pipeline upload when no namespace is given, which is the default. A low-privilege tenant, or an unauthenticated caller if the API server is reachable without an authenticating proxy, can create shared pipelines or inject versions that later run under another tenant's service account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kubeflow","kubernetes","machine-learning","multi-tenant"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Tenant code runs under another tenant's workload service account","analyst_note":"","how_to_check":"- Check the Kubeflow Pipelines version the deployment runs; affected versions are those before `2.18.0`.\n- Check whether `REQUIRE_NAMESPACE_FOR_PIPELINES` is set to true; it defaults to false.\n- Check whether the API server is reachable without an authenticating proxy in front of it.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Multi-user Kubeflow Pipelines deployments before 2.18.0 that run with the default REQUIRE_NAMESPACE_FOR_PIPELINES setting are exposed. Deployments where the API server sits behind an authenticating proxy do not allow anonymous access, but a low-privilege tenant can still exploit the bypass. Single-user deployments and those that set the namespace requirement are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00077,"input_tokens":4517,"output_tokens":636,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77596':13A,16A '/apis/v2beta1/pipelines/upload':104C '/apis/v2beta1/pipelines/upload_version':107C '2.18.0':96C,227C 'access':182C 'account':80B,209C 'anonym':181C 'anoth':76B,200C 'api':57B,154C 'attack':140C 'attacker-control':139C 'authent':63B,161C 'automat':219C 'build':86C 'bypass':170C 'call':108C 'caller':54B,165C 'canuploadversionedpipelin':109C 'check':5A,33B 'control':141C 'creat':66B,134C 'cve':11A,14A 'default':45B,125C 'deploy':88C,172C 'direct':157C 'embed':214C 'embedded-specif':213C 'empti':119C 'enabl':83C,184C 'endpoint':102C 'execut':195C 'exist':144C 'exploit':167C 'expos':180C 'fals':127C 'fix':224C 'follow':189C 'given':41B 'http':101C 'inject':70B,138C,197C 'issu':222C 'kubeflow':1A,17B,26B,81C 'kubernet':18B 'later':73B 'latest':191C 'learn':21B,92C 'let':6A 'low':48B,130C 'low-privileg':47B,129C 'machin':20B,91C 'machine-learn':19B 'miss':3A 'multi':23B,99C 'multi-ten':22B 'multi-us':98C 'namespac':4A,39B,117C,122C,203C 'packag':25B 'permiss':32B,151C 'pin':211C 'pipelin':2A,10A,27B,35B,68B,82C,124C,136C,146C 'portabl':89C 'post':103C,106C 'prior':94C 'privileg':49B,131C 'protect':173C 'proxi':64B,162C,177C 'reachabl':60B,158C 'recur':186C 'requir':121C,149C 'return':111C 'run':74B,187C,216C 'scalabl':90C 'server':58B,155C 'servic':79B,208C 'share':9A,67B,135C,145C 'skip':28B 'specif':198C,215C 'subjectaccessreview':113C 'substitut':220C 'target':116C 'tenant':7A,24B,50B,77B,132C,201C 'unauthent':53B,164C 'unpin':185C 'upload':8A,36B 'user':84C,100C 'version':71B,142C,192C,226C 'without':61B,112C,147C,159C 'workflow':93C 'workload':206C 'write':31B,150C 'write-permiss':30B","nicknames":[],"mitigations":[],"who_affected":"Multi-user Kubeflow Pipelines deployments before 2.18.0 that run with the default REQUIRE_NAMESPACE_FOR_PIPELINES setting are exposed. Deployments where the API server sits behind an authenticating proxy do not allow anonymous access, but a low-privilege tenant can still exploit the bypass. Single-user deployments and those that set the namespace requirement are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","kubeflow","kubernetes","machinelearning","multitenant","package"],"campaign_type":null,"first_public_at":"2026-10-28T03:57:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77596","severity":null,"published_at":"2026-11-05T23:17:00+00:00","modified_at":"2026-11-05T23:17:00+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[{"id":81483,"url":"https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26806,"url":"https://github.com/kubeflow/pipelines/releases/tag/2.18.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81485,"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T03:57:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}