Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118760— Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads

Quick assessment

Affected

kubeflow pipelines

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kubeflow Pipelines 允许用户构建和部署可移植、可扩展的机器学习工作流。在 0.5.1 至 2.17.0 版本中，前端资源（artifact）路由未验证已认证用户是否有权访问所请求的命名空间。若攻击者能够访问前端服务并知晓资源的位置，即可选择其他租户的命名空间，或省略命名空间以访问未受保护的路由处理程序，从而读取资源内容，例如数据集、模型或流水线输出。该问题影响依赖 Kubeflow Pipelines 授权机制实现租户隔离的多用户部署环境。入口层（ingress）的认证虽能识别调用者身份，但并未对

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1003 · OS Credential Dumping T1027 · Obfuscated Files or Information T1040 · Network Sniffing

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads

Source: CVE Program / CVE List V5

Vulnerability Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
kubeflow	pipelines	< 2.17.0	-

II. Public POCs for CVE-2026-118760

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118760

请登录查看更多情报信息。

Vendor Pages for CVE-2026-118760 (1)

🔗 Release Version 2.17.0 · kubeflow/pipelines · GitHub Read full article x_refsource_MISC

Other References for CVE-2026-118760 (4)

https://github.com/kubeflow/pipelines/pull/12860 x_refsource_MISC
https://github.com/kubeflow/pipelines/issues/9889 x_refsource_MISC
https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj x_refsource_CONFIRM
https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118760

Same Patch Batch · kubeflow · 2026-10-29 · 4 CVEs total

CVE-2026-118758	7.5 HIGH	Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the
CVE-2026-118759	7.5 HIGH	Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing
CVE-2026-118761	7.5 HIGH	Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server me

IV. Related Vulnerabilities

Same product: pipelines

Same vendor: kubeflow

Same weakness: CWE-639