The run/recurring-run creation response disclosed source details for a private stored pipeline controlled by another tenant. Entry and authority. An authenticated user knows or guesses another tenant private pipeline UUID. Observed mechanism and consequence. The server returned private pipeline metadata/source in the run-creation response without…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow run creation revealed another tenant stored pipeline
The run/recurring-run creation response disclosed source details for a private stored pipeline controlled by another tenant.
Public disclosure: Oct 29, 2026
Scope
An authenticated user knows or guesses another tenant private pipeline UUID. The server returned private pipeline metadata/source in the run-creation response without corresponding object access.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-KUBEFLOW-RUN-PRIVATE; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-KUBEFLOW-RUN-PRIVATE-01 · CLM-DB233-KUBEFLOW-RUN-PRIVATE-02 · Kubeflow Pipelines security advisory GHSA-v83x-544f-ph2r
At a glance
Patched in 2.18.0; controlled reproduction only, not proof of leaked third-party pipelines.
Limits and uncertaintyFull account
The run/recurring-run creation response disclosed source details for a private stored pipeline controlled by another tenant.
Entry and authority. An authenticated user knows or guesses another tenant private pipeline UUID.
Observed mechanism and consequence. The server returned private pipeline metadata/source in the run-creation response without corresponding object access.
Limits and status. Patched in 2.18.0; controlled reproduction only, not proof of leaked third-party pipelines.
Run or recurring-run creation could refer to a stored pipeline owned by another tenant and return data about its private definition in the creation response. The direct API response is the disclosure surface, which makes this different from subsequent workflow execution or cache poisoning. The advisory does not prove access to all secret values that a pipeline might use at run time.
Mechanism and trust boundary
- 01
Precondition and trust context
An authenticated user knows or guesses another tenant private pipeline UUID.
- 02
Crossed boundary
The server returned private pipeline metadata/source in the run-creation response without corresponding object access.
- 03
Observed limit
Patched in 2.18.0; controlled reproduction only, not proof of leaked third-party pipelines.
Timeline
- Oct 29, 2026Event type unspecified
Initial documented finding
Kubeflow run creation revealed another tenant stored pipeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-KUBEFLOW-RUN-PRIVATE-01The Kubeflow advisory reports: The API built a run or recurring run from a supplied known private pipeline identifier without consistently checking read authorization.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-v83x-544f-ph2rprimary disclosure
Advisory Summary and Proof of Concept
CLM-DB233-KUBEFLOW-RUN-PRIVATE-02The reported repair is version 2.18.0, with the specific affected component and version range described in the advisory.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-v83x-544f-ph2rprimary disclosure
Advisory Affected and Patched Versions
Controls and mitigations
- Check namespace and owner authorization when resolving a stored pipeline before creating or returning a run object; apply the published fix.
- Test both run and recurring-run APIs with private pipeline definitions, including response minimization and linked artifact IDs.
Unknowns and contradictions
- Patched in 2.18.0; controlled reproduction only, not proof of leaked third-party pipelines.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235