CVE-2026-77596

Summary

A missing authorization check in Kubeflow Pipelines before 2.18.0 allows low-privilege users to upload or overwrite pipeline versions in shared namespaces when multi-user mode is enabled but namespace enforcement is disabled, enabling pipeline injection and potential execution of malicious code under another tenant's service account.

Exploitability

Exploitation requires either a low-privilege authenticated user in a misconfigured environment (REQUIRE_NAMESPACE_FOR_PIPELINES=false) or direct API server access without an authenticating proxy for unauthenticated exploitation; the exploit is non-trivial due to the need to craft valid pipeline specifications and trigger unpinned recurring runs.

Blast radius

An attacker could inject malicious pipeline code that executes under another tenant's service account in their namespace, potentially accessing sensitive data or resources within that tenant's scope, but only if an unpinned recurring run is configured to follow the latest version.

Detection

Defenders should monitor for unexpected pipeline upload or version creation events in shared namespaces by low-privilege users, especially when REQUIRE_NAMESPACE_FOR_PIPELINES is false; look for API server logs showing POST /apis/v2beta1/pipelines/upload or POST /apis/v2beta1/pipelines/upload_version requests with empty targetNamespace headers from non-admin users.

Prioritized remediation

Upgrade to Kubeflow Pipelines 2.18.0 or later, which fixes the missing SubjectAccessReview check.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.