CVE-2026-77596: Kubeflow Pipelines authorization bypass in pipeline upload endpoints

Summary

Kubeflow Pipelines versions before 2.18.0 have an authorization bypass in the multi-user endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version. When the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES is at its default of false, canUploadVersionedPipeline returns without a SubjectAccessReview. A low-privilege tenant can thus create shared pipelines or inject versions into existing ones without write permission, and an unauthenticated caller can do the same if the API server is reachable without an authenticating proxy. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account.

Mitigation

Fixed in version 2.18.0.

Related items

• MediumThreat actors use agentic AI tooling to find and abuse exposed secretsSimilar attack · Microsoft Security Blog
• HighCVE-2026-88980: Kubeflow Pipelines artifact fetch flaw enables server-side request forgerySimilar attack · NVD/CVE Database
• HighCVE-2026-113663: AG2 SandboxShellTool command injection via newline separatorsSimilar attack · NVD/CVE Database
• MediumCVE-2026-88986: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-88985: Kubeflow Pipelines SQL injection through page_token list API fieldsSimilar attack · NVD/CVE Database