Kubeflow Pipelines had two ways to write shared pipeline definitions, but they did not enforce the same authorization. In the affected HTTP multipart upload paths, an omitted namespace became an empty value and the helper returned without a Kubernetes SubjectAccessReview. The gRPC sibling instead authorized shared writes against the system namespace. The adv…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow HTTP uploads bypassed authorization for shared pipeline versions
An empty namespace let two HTTP upload paths skip the shared-pipeline authorization check. Downstream execution required a later run to select the unauthorized version; Kubeflow Pipelines 2.18.0 is the documented fix.
Public disclosure: Oct 28, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-KUBEFLOW-SHARED-NS-AUTH · CLM-KUBEFLOW-SHARED-PATCH · Kubeflow Pipelines shared upload authorization advisory
At a glance
The material effect is unapproved shared pipeline code provenance, not proof that another tenant already ran the replacement.
Read the implicationsNeeds an affected configuration and a subsequent consumer of the modified pipeline version. No demonstrated production customer compromise.
Limits and uncertaintyFull account
Kubeflow Pipelines had two ways to write shared pipeline definitions, but they did not enforce the same authorization. In the affected HTTP multipart upload paths, an omitted namespace became an empty value and the helper returned without a Kubernetes SubjectAccessReview. The gRPC sibling instead authorized shared writes against the system namespace. The advisory was published October 28, 2026.
The affected endpoints were /apis/v2beta1/pipelines/upload and upload_version. A low-privilege tenant could submit unauthorized shared definitions; the advisory also describes a possible unauthenticated caller where the API server is reachable. It covers versions through 2.17.3 and identifies 2.18.0 as patched.
The artifact changes before a consumer runs it
An unauthorized version can alter an image, command or arguments. A later tenant run must select that version for the downstream execution consequence to occur. Upload acceptance is therefore not, by itself, proof of a compromised execution host.
This is distinct from the other Kubeflow Pipelines disclosures concerning run-log ownership and archive resource exhaustion. They share a product, not a demonstrated common exploit chain or universal fixed-version boundary. No production victim is established by this advisory.
Mechanism and trust boundary
- 01
A caller reaches an affected HTTP multipart pipeline upload or upload_version endpoint in multi-user mode.
- 02
An empty or omitted namespace selects shared-pipeline handling, and the HTTP helper skips SubjectAccessReview.
- 03
A low-privilege tenant, or an unauthenticated caller where the API is reachable as described in the advisory, submits an unauthorized shared pipeline definition or version.
- 04
A later run that selects the version may execute its altered image, command or arguments; this consumer action is a separate prerequisite.
Claims & evidence
CLM-ENR231-KFP-HTTP-PATHSKubeflow's advisory identifies both HTTP multipart upload and upload_version endpoints, with an empty namespace default that skips SubjectAccessReview, including a possible unauthenticated caller where the API server is reachable.supported
Basis: reported finding
- supportsKubeflow Pipelines shared upload authorization advisoryvendor statement
Summary and Description: HTTP multipart routes, canUploadVersionedPipeline and empty namespace authorization
CLM-KUBEFLOW-SHARED-PATCHKubeflow Pipelines 2.18.0 contains the reported authorization repair for affected releases through 2.17.3.supported
Basis: reported finding
- supportsKubeflow Pipelines shared upload authorization advisoryvendor statement
GHSA-rjr3-43j3-4q8g, Affected versions and Patched versions
CLM-KUBEFLOW-SHARED-NS-AUTHThe upload_version path omitted the normal Kubernetes SubjectAccessReview when the target namespace was empty, which identified a shared pipeline in the affected configuration.supported
Basis: reported finding
- supportsKubeflow Pipelines shared upload authorization advisoryvendor statement
GHSA-rjr3-43j3-4q8g, Description and Root Cause
Implications
The material effect is unapproved shared pipeline code provenance, not proof that another tenant already ran the replacement.
Controls and mitigations
- Upgrade to the documented fixed build, enforce explicit ownership checks for shared pipeline versions and pin trusted pipeline versions in dependent runs.
Unknowns and contradictions
- Needs an affected configuration and a subsequent consumer of the modified pipeline version. No demonstrated production customer compromise.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233