Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployme
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Kubeflow
- Product
- pipelines
- CVSS v3.1
- 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Fix
- available
- Weakness
- CWE-639, CWE-862
- Exposure class
- AI infrastructure
- NVD status
- Received
Why it ranks 43 (Notable)
- CVSS v3.1 9.6 critical
- Product class: AI infrastructure
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-77596 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.