Kubeflow Pipelines: shared-pipeline uploads skip authorization, letting tenants inject code (CVE-2026-77596)
Severity: critical · Patch status: patched · Since 2026-10-28 · CVE-2026-77596
In multi-user mode, Kubeflow Pipelines' API server does not run its SubjectAccessReview check on the multipart upload endpoints (POST /apis/v2beta1/pipelines/upload and uploadversion) when the target namespace is empty. An empty namespace addresses shared, cluster-wide pipelines and is the default when the namespace parameter is omitted. REQUIRENAMESPACEFORPIPELINES defaults to false and is unset in the shipped manifests, so default multi-user installs are affected. Any low-privilege tenant, and any caller that can reach the API server unauthenticated, can create shared pipelines or inject new versions into existing ones. That replaces the image, command and args other tenants run. The gRPC path authorizes the same write against the system namespace, which the advisory treats as the omission. Versions before 2.18.0 are affected. The fix is commit 62516d8c525f, merged 2026-09-09 and first released in 2.18.0 on 2026-10-28. The advisory includes a proof of concept reproduced against the real API server image. No in-the-wild exploitation is reported in the sources reviewed, the CVE is not in CISA KEV, and its EPSS is 0.0025.
What to do
- Upgrade Kubeflow Pipelines to 2.18.0 or later (includes fix commit 62516d8c525f)
- Set REQUIRE_NAMESPACE_FOR_PIPELINES=true in multi-user deployments as a mitigation until upgraded
- Restrict network access to the KFP API server (port 8888) to trusted clients only
- Audit existing shared pipelines for unexpected versions, images, or commands
- Review RBAC grants and API server audit logs for unauthorized pipeline uploads
Fixed versions
Sources
All live incidents on Threat Watch
