The affected backend used its own access to retrieve live or archived pod logs, without establishing that the requesting identity owned the selected pipeline run. In a shared AI/ML pipeline service, such logs can contain model training data paths, runtime arguments or secrets, although the public advisory does not demonstrate any particular secret in a real…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow run-log API could reveal another tenant’s pipeline output
The Kubeflow Pipelines security advisory reports that GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log lacked run-level caller authorization, enabling reads of another run log when IDs and backend access were available.
Scope
A reachable API and target identifiers are prerequisites; deployment ingress authorization may add protection and no production leak is confirmed.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The advisory identifies insufficient run ownership checks on log retrieval. It is a distinct confidentiality issue from archive decompression and still requires a reachable authenticated API context and a target run identifier. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-KUBEFLOW-CROSS-RUN-LOG-1 · Kubeflow Pipelines GHSA-wg5q-x4j9-qm54 run-log access advisory
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsA reachable API and target identifiers are prerequisites; deployment ingress authorization may add protection and no production leak is confirmed.
Limits and uncertaintyFull account
The affected backend used its own access to retrieve live or archived pod logs, without establishing that the requesting identity owned the selected pipeline run. In a shared AI/ML pipeline service, such logs can contain model training data paths, runtime arguments or secrets, although the public advisory does not demonstrate any particular secret in a real deployment.
Mechanism and trust boundary
- 01
Request with a known victim run ID and node ID reaches log retrieval under backend privileges without checking the principal against the chosen run.
Claims & evidence
CLM-2026-NOV01-KUBEFLOW-CROSS-RUN-LOG-1The Kubeflow Pipelines security advisory reports that GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log lacked run-level caller authorization, enabling reads of another run log when IDs and backend access were available.supported
Basis: reported finding
- supportsKubeflow Pipelines GHSA-wg5q-x4j9-qm54 run-log access advisoryprimary disclosure
GHSA-wg5q-x4j9-qm54, Summary and affected run-log handler
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Deploy a fixed Kubeflow Pipelines build and enforce per-run authorization before retrieval, including archived logs.
Unknowns and contradictions
- A reachable API and target identifiers are prerequisites; deployment ingress authorization may add protection and no production leak is confirmed.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 211