Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Affects Kubeflow Pipelines before 2.18.0 in multi-user mode with REQUIRE_NAMESPACE_FOR_PIPELINES unset. Fixed in 2.18.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.18.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Multi-user mode is enabled and REQUIRE_NAMESPACE_FOR_PIPELINES is unset (defaults to false) so empty namespaces pass validation A victim enabled unpinned recurring run that follows the latest version of the targeted shared pipeline is needed for the cross-tenant code execution path
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 18/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Kubeflow Pipelines API server lacks an authorization check on shared pipeline uploads, which lets a low-privilege user reached over the network create shared pipelines or inject attacker-controlled versions into existing ones without the required write permission. Enabled unpinned recurring runs that follow the latest version can then execute the injected specification in another tenant's namespace.
Read the original description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.6/10CVSS 9.6
- No patch0/5No signal
What would change the score
- Would score about 68 if added to CISA KEV
- Would score about 63 if CISA's SSVC rates exploitation active
- Would score about 25 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Multi-user mode is enabled and REQUIRE_NAMESPACE_FOR_PIPELINES is unset (defaults to false) so empty namespaces pass validation A victim enabled unpinned recurring run that follows the latest version of the targeted shared pipeline is needed for the cross-tenant code execution pathUpgrade to a fixed version: 2.18.0.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- kubeflow pipelines
fixed in 2.18.0
Evidence 4
- Advisory
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-77596
Is CVE-2026-77596 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The Pipelines API server does not check authorization when shared pipelines are uploaded, so an upload can reach a shared pipeline it should not control. One path can lead to code execution across tenants, and it needs a victim with an enabled, unpinned recurring run that follows the targeted shared pipeline.Source: github.com
Which versions are affected by CVE-2026-77596?
pipelines: before 2.18.0.Source: cve.now feed data
Am I affected, and how do I check?
Kubeflow Pipelines versions before 2.18.0 are listed as affected, but only in multi-user mode with REQUIRE_NAMESPACE_FOR_PIPELINES unset, which defaults to false. To check a setup, look at the deployed Pipelines version and whether REQUIRE_NAMESPACE_FOR_PIPELINES is set in the API server environment.Source: github.com
How do I fix CVE-2026-77596?
Upgrade Kubeflow Pipelines to 2.18.0 or later, which is the listed fixed version.Source: github.com
Why do the sources disagree?
The description says the flaw can be reached without authentication, but the CVSS vector records PR:L, which means some privileges are required. The sources do not reconcile these two points.Source: github.com