WhatBrokeToday
FAQ
Today's Trends
criticalInvestigatingv< 0.0.0-20260909234119-62516d8c525f

Kubeflow Pipelines API Lacks Authorization for Shared Pipeline Uploads

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

The Kubeflow Pipelines API server multipart upload endpoints fail to perform authorization when the target namespace is empty in multi-user mode, allowing unauthorized uploads. Users are affected if running versions prior to the patched release.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

The authorization helper `canUploadVersionedPipeline` is not properly invoked when the target namespace is empty on HTTP multipart upload endpoints (`POST /apis/v2beta1/pipelines/upload` and `POST /apis/v2beta1/pipelines/upload_version`).

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    github.com/kubeflow/pipelines: Kubeflow Pipelines API server lacks authorization for shared pipeline uploads(opens security advisory in a new tab)

    Fixed in: github.com/kubeflow/pipelines 0.0.0-20260909234119-62516d8c525f. Critical severity (CVE-2026-77596). Affected: github.com/kubeflow/pipelines (go) < 0.0.0-20260909234119-62516d8c525f. ## Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints (`POST /apis/v2beta1/pipelines/upload` and `POST /apis/v2beta1/pipelines/upload_version`) perform no authorization when the target namespace is empty. The authorization helper `canUploadVersionedPipeline`…

    by GitHub Advisory Database 0upvotes 0comments

Timeline

  1. First report on security advisory

    github.com/kubeflow/pipelines: Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

    Source