Cpe:2.3:a:kubeflow:pipelines:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akubeflowpipelines/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:51:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKubeflow Pipelines: API authorization bypass for log access (CVE-2026-118759)https://feed.craftedsignal.io/briefs/2026-10-kubeflow-auth-bypass/Thu, 29 Oct 2026 17:51:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kubeflow-auth-bypass/An authorization bypass in the Kubeflow Pipelines API server allows unauthenticated or unauthorized users to read sensitive logs by manipulating the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler.Kubeflow Pipelines prior to version 2.18.0 contains a vulnerability in the API server log handler. The handler does not perform authorization checks against the requested run ID, allowing any caller with network access to the API server to retrieve logs. For live logs, the vulnerability allows an attacker to specify a node ID as a pod name, which enables cross-namespace log access for pods not associated with the requested run. This can lead to the exposure of sensitive workload data or hardcoded credentials.

Impact

Unauthorized access to logs across the Kubeflow environment. Observed potential impact includes unauthorized reading of sensitive workload data and exposure of credentials stored within pipeline logs.

Recommendation

  • Upgrade Kubeflow Pipelines to version 2.18.0 or later immediately.
  • Evaluate current network policies and authentication gates surrounding the Kubeflow API server to ensure requests are limited to trusted clients, as the API handler does not perform independent authentication.
]]>highadvisoryapi-securitykubernetesdata-exposurepath-traversalweb-application