Kubeflow Pipelines CVE-2026-118760

Exploitable only in multi-user Kubeflow Pipelines deployments that rely on KFP's authorization for tenant isolation; standalone/single-tenant deployments are not in the same multi-tenant threat model. The attacker must be an authenticated caller able to reach the frontend (identified at ingress) and must know the target artifact's storage location, then either select another tenant's namespace on the artifact route or omit the namespace to reach the unguarded direct handler. Limiting factors: authentication is required (low-privilege, PR:L), the flaw yields read-only confidentiality impact only (no integrity/availability, no secret disclosure or code execution), and the deployment must be the affected kfp-frontend component versions >= 0.5.1 and < 2.17.0. The only complete fix stated by the vendor is upgrading the frontend and matching KFP/RBAC manifests to 2.17.0 or later and using the supported multi-user auth configuration.

This is a genuine but moderate-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) describes a network-reachable, low-complexity flaw exploitable by an authenticated low-privilege user (PR:L), yielding high confidentiality impact with no integrity or availability impact - matching the advisory's description of unauthorized cross-tenant artifact reads with no write, secret-disclosure, or code-execution capability. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a Medium-severity, confidentiality-only authorization flaw that requires a specific multi-user deployment to be exploitable. No EPSS score, CISA KEV listing, or SSVC decision framework data was supplied, so probability-of-exploitation and automatability cannot be assessed from the input; their absence is not evidence of low risk but means there is no signal of active or widespread exploitation. The provided references are the vendor advisory, upstream issue, fix PR, fix commit, and release - none is verified exploit code, so there is no public exploit identified at time of analysis. Net: a real tenant-isolation breach worth remediating on a normal patch cycle for affected multi-user operators, not a drop-everything emergency; raw CVSS of 6.5 is not inflated here.

In a multi-user Kubeflow Pipelines deployment, an authenticated low-privilege tenant who can reach the frontend supplies another tenant's namespace (or omits the namespace to hit an unguarded direct handler) on an artifact route and, knowing an artifact's storage location, downloads that tenant's datasets, models, or pipeline outputs. Because authentication at ingress identified the caller but no namespace authorization check was performed, the request succeeds. No public exploit code is identified at time of analysis, though the vendor advisory and fix diff describe the flaw in detail.