Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…elines/security/advisories/GHSA-ghgh-57qv-h687 Diğer
• github.com/kubeflow/pipelines/pull/13288 Diğer
• github.com/…ommit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c Diğer
• github.com/kubeflow/pipelines/releases/tag/2.16.1 Diğer

Kayıt geçmişi

1. 6 Kas 2026 01:13Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-88982Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
• 9,6 CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
• 8,6 CVE-2026-88981Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
• 8,6 CVE-2026-88980Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
• 5,8 CVE-2026-88979Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
• 6,1 CVE-2026-88986Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses