Decoded or encoded artifact object path forms crossed Kubeflow namespace authorization checks. Entry and authority. An affected Kubeflow frontend serves tenant-associated artifact paths and permits crafted encoded path segments. Observed mechanism and consequence. A request for one namespace could be normalized into another namespace artifact location…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow artifact authorization differed across decoded paths
Decoded or encoded artifact object path forms crossed Kubeflow namespace authorization checks.
Public disclosure: Oct 29, 2026
Scope
An affected Kubeflow frontend serves tenant-associated artifact paths and permits crafted encoded path segments. A request for one namespace could be normalized into another namespace artifact location after access checks.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-KUBEFLOW-ARTIFACT-NORMALIZE; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-KUBEFLOW-ARTIFACT-NORMALIZE-01 · CLM-DB233-KUBEFLOW-ARTIFACT-NORMALIZE-02 · Kubeflow Pipelines security advisory GHSA-9gj7-33j5-r3v3
At a glance
Affects reported >=2.17.0 to <=2.17.3; patched 2.18.0; no confirmed live compromise.
Limits and uncertaintyFull account
Decoded or encoded artifact object path forms crossed Kubeflow namespace authorization checks.
Entry and authority. An affected Kubeflow frontend serves tenant-associated artifact paths and permits crafted encoded path segments.
Observed mechanism and consequence. A request for one namespace could be normalized into another namespace artifact location after access checks.
Limits and status. Affects reported >=2.17.0 to <=2.17.3; patched 2.18.0; no confirmed live compromise.
Artifact access rules compared storage paths before all encoding and normalization steps were consistent. An alternate encoded form could refer to the same object while passing a different namespace or ownership check. The advisory concerns artifact route authorization, not a claim that arbitrary Kubeflow pipeline execution privileges were obtained.
Mechanism and trust boundary
- 01
Precondition and trust context
An affected Kubeflow frontend serves tenant-associated artifact paths and permits crafted encoded path segments.
- 02
Crossed boundary
A request for one namespace could be normalized into another namespace artifact location after access checks.
- 03
Observed limit
Affects reported >=2.17.0 to <=2.17.3; patched 2.18.0; no confirmed live compromise.
Timeline
- Oct 29, 2026Event type unspecified
Initial documented finding
Kubeflow artifact authorization differed across decoded paths
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-KUBEFLOW-ARTIFACT-NORMALIZE-01The Kubeflow advisory reports: Authorization matched one path representation while the storage client normalized another.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-9gj7-33j5-r3v3primary disclosure
Advisory Summary and Proof of Concept
CLM-DB233-KUBEFLOW-ARTIFACT-NORMALIZE-02The reported repair is version 2.18.0, with the specific affected component and version range described in the advisory.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-9gj7-33j5-r3v3primary disclosure
Advisory Affected and Patched Versions
Controls and mitigations
- Normalize and decode artifact identifiers once before tenant authorization, and validate the final object path as belonging to the requesting namespace.
- Test equivalent encoded, escaped and normalized paths with two isolated tenant artifact stores under the patched release.
Unknowns and contradictions
- Affects reported >=2.17.0 to <=2.17.3; patched 2.18.0; no confirmed live compromise.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235