The report
A cached pipeline result does not necessarily belong to the tenant requesting it. One Kubeflow Pipelines advisory describes a version of the cache path whose lookup identity omitted namespace, allowing another tenant's output to be reused when the remaining key matched. Three other advisories involve different components: private pipeline data exposed through run creation, an artifact fetcher accepting arbitrary storage endpoints, and an authorization check that disagreed with a normalized artifact path. The project identifies version 2.18.0 as the correction for the disclosed issues.
The same tenant was not enforced at each boundary
| Finding | Entry point | Reported consequence |
|---|---|---|
| Namespace-blind cache | Cross-tenant execution cache lookup | Reuse of another namespace's output, potentially poisoning later computations |
| Stored-pipeline run creation | Run or recurring-run API supplied a known private pipeline ID | Private pipeline information returned to an unauthorized requester |
| Artifact endpoint selection | Artifact download accepted caller-chosen S3/MinIO details | Server-side request to an unauthorized destination in standalone UI conditions |
| Artifact object path normalization | Encoded and decoded artifact names interpreted differently | Cross-namespace artifact read through the affected fallback route |
This is not one exploit replayed four times. A cache key lacks context, a run constructor skips a read check, a frontend fetcher trusts a caller-supplied provider, and a storage route applies authorization to the wrong representation of a path. Consequently, a single patch such as escaping an artifact name would not establish the other three protections.
The earlier cross-run log and archive investigation describes two different Kubeflow issues. Their presence in the knowledge base should not be mistaken for coverage of this later four-part set.
What remains conditional
The advisories support the stated paths and their specified deployment and version ranges; they do not provide a measured count of affected multi-tenant deployments, evidence of a production adversary using them, or proof that every backend storage configuration is exploitable. Cache poisoning requires matching execution context, the stored-pipeline path requires a known private identifier, and the artifact issues depend on their respective UI and storage configurations.
The meaningful validation is two-account testing on the patched release. Run both accounts against independent namespaces, exercise repeated cached computations, private run creation and equivalent encoded artifact paths, and observe the final storage request as well as the API's apparent authorization response.