Evidence · DiggingBeagle record
Kubeflow Pipelines security advisory GHSA-3pcj-8j5w-jmxq
Independent Kubeflow Pipelines authorization or artifact handling disclosure.
- Published
- Oct 28, 2026
- Source role
- primary disclosure
Evidence record
Independent Kubeflow Pipelines authorization or artifact handling disclosure.
Claim-level citations (2)
- supportsKubeflow artifact download accepted arbitrary storage endpoints: The Kubeflow advisory reports: The frontend accepted caller-selected S3/MinIO provider metadata as part of artifact download.
Advisory Summary and Proof of Concept
- supportsKubeflow artifact download accepted arbitrary storage endpoints: The reported repair is version 2.18.0, with the specific affected component and version range described in the advisory.
Advisory Affected and Patched Versions