Kubeflow Pipelines

Record description

Kubeflow Pipelines supports running and tracking machine-learning workflows. Two distinct security advisories concern its API-server trust boundaries: a log retrieval path that could disclose another run when ownership was not checked, and decompression of uploaded pipeline archives that could exhaust shared service resources. The first involves authorizing the requested run, whereas the second involves validating the computational cost of an untrusted upload. They are not proof of one combined exploit or of observed production compromise.

A third, distinct advisory concerns uploading versions of shared pipelines in multi-user mode. Empty namespace values could bypass Kubernetes SubjectAccessReview and allow an unauthorized tenant to change a shared version, potentially affecting later runs that select it. This is a modification-of-shared-artifact risk rather than cross-run log disclosure or archive resource exhaustion. The documented fix is Kubeflow Pipelines 2.18.0.

The shared-upload advisory describes a precise mismatch between two write interfaces: the HTTP upload helper exits without Kubernetes SubjectAccessReview for an empty namespace, while the gRPC sibling authorizes shared writes against the system namespace. The default multi-user configuration permits an omitted namespace, so the affected HTTP path is not limited to unusual tenant settings. Its downstream code-execution implication requires another run to select the unauthorized pipeline version. Kubeflow Pipelines 2.18.0 is the reported fix for this separate issue, not evidence that the older run-log or archive-exhaustion advisories shared the same cause.

Explicitly related research (2)

Declared connections