Evidence · DiggingBeagle record
Kubeflow Pipelines GHSA-wg5q-x4j9-qm54 run-log access advisory
Reviewed GitHub advisory for missing ownership checks on run/node log retrieval.
- Source role
- primary disclosure
Evidence record
Reviewed GitHub advisory for missing ownership checks on run/node log retrieval.
Claim-level citations (1)
- supportsKubeflow run-log API could reveal another tenant’s pipeline output: The Kubeflow Pipelines security advisory reports that GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log lacked run-level caller authorization, enabling reads of another run log when IDs and backend access were available.
GHSA-wg5q-x4j9-qm54, Summary and affected run-log handler