Kubeflow Pipelines Shared Upload Authorization Bypass (CVE-2026-77596)

CVE-2026-77596 is an authorization gap in the upload endpoints of the Kubeflow Pipelines API server. Kubeflow Pipelines builds and deploys machine learning workflows. In multi-user mode, the server should check that a caller may write a pipeline before it accepts an upload.

The maintainers say that check is skipped when the target namespace is empty. An empty namespace is how Kubeflow Pipelines addresses shared, cluster-wide pipelines, and it is the default when a caller names no namespace. The setting that would require a namespace defaults to false and is unset in the shipped manifests.

What an Attacker Gains

Per the advisory, a low-privilege tenant can create shared pipelines or add attacker-controlled versions to existing shared pipelines without the write permission. The CVE record adds that an unauthenticated caller can do the same when the API server is reachable without an authenticating proxy. Deployments behind such a proxy do not expose anonymous access.

The advisory's automatic path to code execution needs an enabled recurring run that follows the latest version of the shared pipeline. That run then executes the injected specification in another tenant's namespace, under that workload's service account. Runs pinned to a version, or with an embedded specification, are not substituted automatically.

The maintainers limit the impact. They say execution gets the victim workload's permissions and mounted data, and it does not by itself grant every secret in the namespace or cluster-admin rights. They also say they verified the scheduled-run path by source inspection and did not reproduce it end to end.

We leave out request details on purpose. Our least privilege entry explains the principle this flaw bypasses.

How the Score Reads

GitHub, the CNA, scores it CVSS 3.1 9.6 Critical with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. NVD lists GitHub's score as secondary and shows the entry as received on 5 November 2026. There is no CVSS 4.0 score in the record or NVD.

The maintainers say the vector assesses the authenticated tenant scenario. Scope is changed because the consequence reaches a different tenant's namespace and service account. See our CVSS entry for how to read the vector.

What the Maintainers and CISA KEV Say

The advisory says the first fixed release is 2.18.0 and that releases through 2.17.3 remain affected. As of CISA catalog version 2026.11.04, the CVE is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.

The CVE record lists Kubeflow Pipelines before 2.18.0 as affected. The GitHub advisory states the range as 2.17.3 and earlier and names 2.18.0 as the patched version. It lists the kfp-api-server container image as the affected software.

The advisory describes multi-user deployments and says the fix leaves single-user behavior unchanged. After the upgrade, shared uploads that earlier scripts or clients relied on are rejected. Plan client changes before you roll out.

The advisory names two client changes. In the user interface, choose Private for tenant-owned pipelines. In the Python SDK, pass the tenant namespace explicitly on upload. Our vulnerability management guide covers rollout planning.

GitHub credits the reporter as VitoCrl. The maintainers merged the fix into the master branch on 9 September 2026, in pull request 14352.