EUVD-2026-46422Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account via auto profile creation
-
DeliveryPatch/create malicious Istio EnvoyFilter on gateway
-
ExploitVictim uses Dashboard/Pipelines/Notebooks
-
ExecutionCapture victim authorization token
-
ImpactReplay token to hijack account and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The attacker must hold a valid Kubeflow account with the kubeflow-edit / Contributor role in any (even a random) namespace - a prerequisite that is automatically satisfied when the Automatic Profile Creation feature is enabled, allowing self-service signup to yield the needed role. Exploitation further depends on the vulnerable pre-26.03-rc.1 Istio manifests that grant Contributors write access (create/patch) to Istio EnvoyFilter resources, and on a targeted victim actively using the Kubeflow UI or APIs so their authorization token traverses the manipulated ingress path (CVSS UI:R). Limiting factors: the attack fails on single-tenant clusters where the attacker is the only user, on deployments with Automatic Profile Creation disabled and tightly controlled profile provisioning, and on 26.03-rc.1+ where the write verbs are removed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) indicates a network-reachable, low-complexity attack that nonetheless requires an authenticated foothold (PR:L) and victim interaction (UI:R), since the attacker must wait for a targeted user to use the UI/API so their token can be captured. This is a genuine multi-tenant isolation break: on any Kubeflow deployment with Automatic Profile Creation enabled, self-service signup effectively satisfies the PR:L prerequisite, lowering the barrier considerably. No EPSS score, POC, or KEV status was supplied, so there is no evidence of active exploitation or public exploit code - the risk is driven by impact (cross-tenant account takeover) rather than demonstrated mass exploitation. Priority should be high for multi-tenant Kubeflow clusters with untrusted or numerous users, and lower for single-tenant/internal deployments where all Contributors are already trusted. |
| Exploit ScenarioDerived | An attacker signs up (or is auto-provisioned via Automatic Profile Creation) as a Contributor in their own Kubeflow namespace, then uses their kubeflow-edit rights to create or patch an Istio EnvoyFilter on the shared ingress gateway that siphons authorization tokens from other users' requests. When a victim next logs into the Dashboard, Pipelines API, or Notebooks (UI:R), their token is captured and the attacker replays it to take over the account and its data. No public exploit code is identified at time of analysis, but the manifest diff clearly reveals the vulnerable permission set. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade to Kubeflow Community Distribution 26.03-rc.1, which removes the create/delete/deletecollection/patch/update verbs from the kubeflow-edit-accessible Istio ClusterRole and drops the add-anonymous-user-filter EnvoyFilter (see GHSA-v824-8gxh-pgjw and PR #3043). If you cannot upgrade immediately, manually edit common/istio-1-24/kubeflow-istio-resources/base/cluster-roles.yaml (and the istio-cni-1-24 equivalent) to remove the write verbs on Istio networking resources so Contributors can no longer create or patch EnvoyFilters - the trade-off is that any legitimate tenant workflow relying on self-service EnvoyFilter changes will break. Additionally, disable Automatic Profile Creation to prevent untrusted users from obtaining the kubeflow-edit/Contributor role by self-signup (trade-off: administrators must provision profiles/namespaces manually), and restrict who can register accounts on the Kubeflow UI/oauth2-proxy front end.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kubeflow Community Distribution packages the Kubeflow ML platform on Kubernetes using the official manifests, fronted by an Istio service mesh and oauth2-proxy for identity. The root cause is CWE-266 (Incorrect Privilege Assignment): the kubeflow-edit ClusterRole (bound to Contributor users) granted create/delete/deletecollection/patch/update verbs on Istio networking resources such as EnvoyFilters. The fix (PR #3043, commit 31b2411) comments out those write verbs in common/istio-1-24 and common/istio-cni-1-24 kubeflow-istio-resources cluster-roles.yaml with the note that they 'could destabilize the platform and allow exploits,' and removes the pre-existing add-anonymous-user-filter EnvoyFilter. Because EnvoyFilters modify how the ingress gateway processes requests and headers, a tenant able to create or patch them can insert logic that intercepts or redirects the identity/authorization tokens of other authenticated users passing through the mesh.
Know when Kubeflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable but needs an authenticated Contributor foothold (PR:L) and a victim interacting with the UI so their token can be stolen (UI:R), yielding full account/data compromise (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the `kubeflow-edit` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue.
Articles & Coverage 1
Executive ViewAI
Kubeflow Community Distribution contains an authorization bypass allowing low-privileged authenticated users to steal other users' session tokens across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. No public exploit identified at time of analysis. Organizations using Kubeflow with Automatic Profile Creation enabled face immediate risk of lateral privilege escalation and unauthorized data access, as the default configuration automatically assigns the vulnerable kubeflow-edit role to all users.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Automatic Profile Creation if operationally feasible to prevent default assignment of vulnerable roles; (2) Restrict kubeflow-edit and Contributor role assignments to essential personnel only; (3) Enforce multi-factor authentication for Kubeflow Dashboard and Pipelines API access; (4) Implement continuous monitoring and anomaly detection to identify token replay and unusual authentication patterns; (5) Apply network segmentation to restrict access to Kubeflow authentication services; (6) Monitor Kubeflow security advisories for patch release and maintain upgrade readiness.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expr
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow. Rated medium severity (CVSS 6.5), this vulnerability is remotel
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow. Rated medium severity (CVSS 6.1), this vulnerability is rem
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network
Path traversal in the Kubeflow Pipelines volume artifact handler (versions through 2.17.3, fixed in 2.18.0) lets a remot
Memory exhaustion in the Kubeflow Pipelines API server (versions through 2.17.3) lets a network-reachable, unauthenticat
Unauthorized log disclosure in the Kubeflow Pipelines API server allows a caller who can reach the backend and supply a
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. Rated high severity (CVSS 7.1), this vulnerabi
Cross-tenant artifact disclosure in the Kubeflow Pipelines frontend (kfp-frontend) lets an authenticated user who can re
Exploit-DB