What is the CVSS score of CVE-2026-47237?

CVE-2026-47237 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Kubeflow are affected by CVE-2026-47237?

Kubeflow Community Distribution contains an authorization bypass allowing low-privileged authenticated users to steal other users' session tokens across the Dashboard, Pipelines API, and Notebooks,…. A patch is available.

How to fix or mitigate CVE-2026-47237?

Within 24 hours: Audit all Kubeflow deployments to identify those with Automatic Profile Creation enabled and document users holding kubeflow-edit/Contributor roles; implement enhanced monitoring for anomalous authentication and token activity patterns. Within 7 days: Restrict kubeflow-edit role assignments to essential users only, disable Automatic Profile Creation if operationally viable, and enforce multi-factor authentication for all Kubeflow API and Dashboard access. Within 30 days: Prioritize upgrade to Kubeflow Community Distribution version 26.03-rc.1 or later once available and conduct a comprehensive audit of all user account activity for the preceding 90 days to detect unauthorized access.

Kubeflow CVE-2026-47237

EUVD-2026-46422 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-21 GitHub_M

Information Disclosure Kubernetes Kubeflow Community Distribution

8.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network-reachable but needs an authenticated Contributor foothold (PR:L) and a victim interacting with the UI so their token can be stolen (UI:R), yielding full account/data compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 21, 2026 - 23:36 EUVD

Source Code Evidence Fetched

Jul 21, 2026 - 21:41 vuln.today

Analysis Generated

Jul 21, 2026 - 21:41 vuln.today

CVE Published

Jul 21, 2026 - 20:49 cve.org

HIGH 8.0

DescriptionCVE.org

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the `kubeflow-edit` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue.

Articles & Coverage 1

News 3 New Kubernetes Vulnerabilities - 3 High Severity, 1 With POC Jul 21, 2026

AnalysisAI

Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Kubeflow Community Distribution packages the Kubeflow ML platform on Kubernetes using the official manifests, fronted by an Istio service mesh and oauth2-proxy for identity. The root cause is CWE-266 (Incorrect Privilege Assignment): the kubeflow-edit ClusterRole (bound to Contributor users) granted create/delete/deletecollection/patch/update verbs on Istio networking resources such as EnvoyFilters. The fix (PR #3043, commit 31b2411) comments out those write verbs in common/istio-1-24 and common/istio-cni-1-24 kubeflow-istio-resources cluster-roles.yaml with the note that they 'could destabilize the platform and allow exploits,' and removes the pre-existing add-anonymous-user-filter EnvoyFilter. Because EnvoyFilters modify how the ingress gateway processes requests and headers, a tenant able to create or patch them can insert logic that intercepts or redirects the identity/authorization tokens of other authenticated users passing through the mesh.

RemediationAI

Vendor-released patch: upgrade to Kubeflow Community Distribution 26.03-rc.1, which removes the create/delete/deletecollection/patch/update verbs from the kubeflow-edit-accessible Istio ClusterRole and drops the add-anonymous-user-filter EnvoyFilter (see GHSA-v824-8gxh-pgjw and PR #3043). If you cannot upgrade immediately, manually edit common/istio-1-24/kubeflow-istio-resources/base/cluster-roles.yaml (and the istio-cni-1-24 equivalent) to remove the write verbs on Istio networking resources so Contributors can no longer create or patch EnvoyFilters - the trade-off is that any legitimate tenant workflow relying on self-service EnvoyFilter changes will break. Additionally, disable Automatic Profile Creation to prevent untrusted users from obtaining the kubeflow-edit/Contributor role by self-signup (trade-off: administrators must provision profiles/namespaces manually), and restrict who can register accounts on the Kubeflow UI/oauth2-proxy front end.