A shared Kubeflow Pipelines cache key omitted tenant namespace and allowed one tenant to influence outputs used by another. Entry and authority. Shared execution caches under <=2.17.3 are populated from different tenants. Observed mechanism and consequence. Cache-hit substitution can return prior outputs from another user environment without actually…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow cache reused other tenants outputs under a namespace-blind key
A shared Kubeflow Pipelines cache key omitted tenant namespace and allowed one tenant to influence outputs used by another.
Public disclosure: Oct 28, 2026
Scope
Shared execution caches under <=2.17.3 are populated from different tenants. Cache-hit substitution can return prior outputs from another user environment without actually rerunning the requested task.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-KUBEFLOW-CACHE-TENANT; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-KUBEFLOW-CACHE-TENANT-01 · CLM-DB233-KUBEFLOW-CACHE-TENANT-02 · Kubeflow Pipelines security advisory GHSA-2xwh-426q-42c5
At a glance
Patch version 2.18.0; no verified real tenant data leakage or production output corruption.
Limits and uncertaintyFull account
A shared Kubeflow Pipelines cache key omitted tenant namespace and allowed one tenant to influence outputs used by another.
Entry and authority. Shared execution caches under <=2.17.3 are populated from different tenants.
Observed mechanism and consequence. Cache-hit substitution can return prior outputs from another user environment without actually rerunning the requested task.
Limits and status. Patch version 2.18.0; no verified real tenant data leakage or production output corruption.
The Kubeflow Pipelines cache reused an entry based on task inputs without binding the key to the requesting tenant namespace. A later tenant could receive results or artifacts originating from another tenant's execution, with potential data contamination and loss of result provenance. The finding does not show every shared cache actually contained sensitive output or establish a measured production victim count.
Mechanism and trust boundary
- 01
Precondition and trust context
Shared execution caches under <=2.17.3 are populated from different tenants.
- 02
Crossed boundary
Cache-hit substitution can return prior outputs from another user environment without actually rerunning the requested task.
- 03
Observed limit
Patch version 2.18.0; no verified real tenant data leakage or production output corruption.
Timeline
- Oct 28, 2026Event type unspecified
Initial documented finding
Kubeflow cache reused other tenants outputs under a namespace-blind key
- Oct 28, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-KUBEFLOW-CACHE-TENANT-01The Kubeflow advisory reports: The affected v2 cache server reuses execution results across namespaces if its cache hash and lookup context align.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-2xwh-426q-42c5primary disclosure
Advisory Summary and Proof of Concept
CLM-DB233-KUBEFLOW-CACHE-TENANT-02The reported repair is version 2.18.0, with the specific affected component and version range described in the advisory.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-2xwh-426q-42c5primary disclosure
Advisory Affected and Patched Versions
Controls and mitigations
- Include tenant/project identity and relevant authorization scope in cache keys and enforce authorization when returning cached artifacts.
- Invalidate or segregate previously shared cache entries and test repeated pipeline runs under separate namespaces.
Unknowns and contradictions
- Patch version 2.18.0; no verified real tenant data leakage or production output corruption.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235