Kubeflow
Monthly
Memory exhaustion in the Kubeflow Pipelines API server (versions through 2.17.3) lets a network-reachable, unauthenticated caller submit a small ZIP or gzip-compressed tar archive that expands disproportionately while the server locates or reads the pipeline file, potentially exhausting API-server memory and interrupting service. The multipart pipeline and pipeline-version upload endpoints decompress the archive before namespace authorization, so no successful pipeline-create decision is required - although external authentication and network controls in front of the API server can restrict reachability, and the URL-import handlers authorize before fetching remote archives and are therefore not on this pre-authorization path. No public exploit code and no confirmed active exploitation were identified at time of analysis; the impact is bounded to availability (C:N/I:N/A:H) and no single archive is guaranteed to exhaust every deployment, since the expansion needed depends on resource limits and concurrent activity. Fixed in 2.18.0.
Unauthorized log disclosure in the Kubeflow Pipelines API server allows a caller who can reach the backend and supply a valid run ID plus a pod or node identifier to read live or archived run logs using the API server's own Kubernetes permissions. Because the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler does not authorize the caller against the selected run, and for live logs treats the caller-supplied node ID as a pod name without checking the pipeline/runid label, a known run ID can also be used to pull the main container logs of unrelated pods in that namespace, potentially exposing workload data or credentials; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality impact, and the handler performs no authentication itself, so deployments behind an external authentication gate or network policy have materially reduced exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor prioritizes the fix for this week's patch cycle. Affected deployments are those running the kfp-api-server image through version 2.17.3; version 2.18.0 contains the fix.
Path traversal in the Kubeflow Pipelines volume artifact handler (versions through 2.17.3, fixed in 2.18.0) lets a remote caller who can reach GET /artifacts/get?source=volume and name an existing mounted volume read files outside that volume, as long as the serving process can read them - disclosed files may include configuration or mounted credentials. The request is served by the frontend pod when artifact proxying is disabled, or by the selected namespace's artifact-service pod when proxying is enabled; in a deployment with authentication disabled no application credentials are required (matching the PR:N vector), while multi-user deployments require the caller to already be authorized for the supplied namespace. This is a genuine but bounded priority: impact is limited to confidentiality of process-readable files outside the selected volume, and the issue does not by itself establish cluster compromise, file modification, or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-tenant artifact disclosure in the Kubeflow Pipelines frontend (kfp-frontend) lets an authenticated user who can reach the UI read another tenant's datasets, models, or pipeline outputs by naming that tenant's namespace on the artifact route, or by omitting the namespace entirely to fall through to an unguarded direct handler. Only multi-user deployments that rely on KFP authorization for tenant isolation are in scope, running kfp-frontend from 0.5.1 up to but not including 2.17.0; the assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting read-only confidentiality impact with no integrity, availability, secret-disclosure, or code-execution effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the flaw in 2.17.0.
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Memory exhaustion in the Kubeflow Pipelines API server (versions through 2.17.3) lets a network-reachable, unauthenticated caller submit a small ZIP or gzip-compressed tar archive that expands disproportionately while the server locates or reads the pipeline file, potentially exhausting API-server memory and interrupting service. The multipart pipeline and pipeline-version upload endpoints decompress the archive before namespace authorization, so no successful pipeline-create decision is required - although external authentication and network controls in front of the API server can restrict reachability, and the URL-import handlers authorize before fetching remote archives and are therefore not on this pre-authorization path. No public exploit code and no confirmed active exploitation were identified at time of analysis; the impact is bounded to availability (C:N/I:N/A:H) and no single archive is guaranteed to exhaust every deployment, since the expansion needed depends on resource limits and concurrent activity. Fixed in 2.18.0.
Unauthorized log disclosure in the Kubeflow Pipelines API server allows a caller who can reach the backend and supply a valid run ID plus a pod or node identifier to read live or archived run logs using the API server's own Kubernetes permissions. Because the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler does not authorize the caller against the selected run, and for live logs treats the caller-supplied node ID as a pod name without checking the pipeline/runid label, a known run ID can also be used to pull the main container logs of unrelated pods in that namespace, potentially exposing workload data or credentials; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality impact, and the handler performs no authentication itself, so deployments behind an external authentication gate or network policy have materially reduced exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor prioritizes the fix for this week's patch cycle. Affected deployments are those running the kfp-api-server image through version 2.17.3; version 2.18.0 contains the fix.
Path traversal in the Kubeflow Pipelines volume artifact handler (versions through 2.17.3, fixed in 2.18.0) lets a remote caller who can reach GET /artifacts/get?source=volume and name an existing mounted volume read files outside that volume, as long as the serving process can read them - disclosed files may include configuration or mounted credentials. The request is served by the frontend pod when artifact proxying is disabled, or by the selected namespace's artifact-service pod when proxying is enabled; in a deployment with authentication disabled no application credentials are required (matching the PR:N vector), while multi-user deployments require the caller to already be authorized for the supplied namespace. This is a genuine but bounded priority: impact is limited to confidentiality of process-readable files outside the selected volume, and the issue does not by itself establish cluster compromise, file modification, or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-tenant artifact disclosure in the Kubeflow Pipelines frontend (kfp-frontend) lets an authenticated user who can reach the UI read another tenant's datasets, models, or pipeline outputs by naming that tenant's namespace on the artifact route, or by omitting the namespace entirely to fall through to an unguarded direct handler. Only multi-user deployments that rely on KFP authorization for tenant isolation are in scope, running kfp-frontend from 0.5.1 up to but not including 2.17.0; the assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting read-only confidentiality impact with no integrity, availability, secret-disclosure, or code-execution effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the flaw in 2.17.0.
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.