CVE-2026-118760 in Pipelines
Summary
by MITRE • 10/29/2026
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
Kubeflow Pipelines serves as a critical infrastructure for orchestrating machine learning workflows, allowing data scientists and engineers to build, deploy, and manage scalable ML pipelines. In multi-user deployments, the system relies on namespace-based isolation to ensure that different tenants or teams can operate independently without interfering with each other's resources. This architectural design assumes that access controls enforced at various layers of the application stack will prevent unauthorized users from accessing data belonging to other namespaces. However, a significant security flaw was identified in versions ranging from 0.5.1 through 2.17.0, where this assumption proved incorrect due to insufficient authorization checks within the frontend artifact routes.
The core technical vulnerability lies in the handling of requests for artifacts such as datasets, trained models, and pipeline outputs. While the ingress layer correctly authenticates users, verifying their identity, it fails to enforce proper access control policies when routing these authentication-verified requests to specific namespaces. Specifically, the frontend artifact endpoints did not validate whether the authenticated user possessed the necessary permissions to read resources within the requested namespace. This oversight allowed an attacker who had valid credentials and knew or could guess a target artifact's location to manipulate the request parameters. By explicitly selecting another tenant's namespace in the URL path or omitting the namespace parameter entirely, the attacker could bypass isolation mechanisms and access sensitive data stored by other users.
This flaw represents a classic case of broken object level authorization, where the application fails to ensure that an authenticated user is authorized to perform actions on specific objects within their scope. The operational impact is severe for organizations relying on Kubeflow Pipelines for multi-tenant machine learning operations. Attackers could exfiltrate proprietary datasets, steal intellectual property contained in trained models, or view sensitive pipeline outputs that may contain confidential business logic or personal information. Although the vulnerability does not lead to arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution, the potential for data leakage and competitive disadvantage remains high. The issue is particularly dangerous because it exploits legitimate authentication pathways rather than bypassing them entirely, making detection through standard intrusion monitoring more difficult.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically focusing on the failure to enforce proper access control for specific objects or resources within an application's scope. In terms of adversary behavior, it corresponds to techniques found in the MITRE ATT&CK framework related to Collection and Exfiltration over Application Layer Protocols, where attackers leverage valid credentials to move laterally and extract data from compromised systems. The vulnerability highlights a common pitfall in web application security: assuming that authentication implies authorization across all resource boundaries without explicit verification at each access point.
To mitigate this risk, organizations must upgrade their Kubeflow Pipelines installations to version 2.17.0 or later, where the artifact route handlers have been patched to enforce strict namespace-level authorization checks before serving any content. For environments that cannot immediately patch due to operational constraints, temporary mitigations should include restricting access to the frontend interface through network policies and ensuring that only trusted users can reach the application layer. Additionally, implementing robust logging and monitoring for anomalous requests involving unexpected namespace parameters can help detect exploitation attempts in real-time. Regular security audits of API endpoints are essential to ensure that authentication mechanisms are consistently paired with rigorous authorization checks across all service components.