Skip to content
Threat Feed
Subscribe

Vendor

Kubeflow

3 briefs RSS
high advisory

Kubeflow Pipelines: API authorization bypass for log access (CVE-2026-118759)

An authorization bypass in the Kubeflow Pipelines API server allows unauthenticated or unauthorized users to read sensitive logs by manipulating the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler.

Kubeflow Pipelines api-security kubernetes data-exposure path-traversal web-application
1t 2c
high advisory

Kubeflow Model Registry Server-Side Request Forgery

Kubeflow Model Registry versions up to 0.3.17 contain a server-side request forgery vulnerability allowing namespace users to exfiltrate ServiceAccount tokens and gain cluster-wide privileges.

Model Registry kubernetes ssrf cloud-native kubeflow
2t 1c
high advisory

Improper Authorization in Data Science Pipelines (CVE-2026-18620)

An authorization bypass vulnerability in Data Science Pipelines allows restricted tenants to execute containers with elevated privileges by specifying a highly-privileged ServiceAccount in a CreateRun request.

Data Science Pipelines privilege-escalation kubeflow cloud-native
1t 1c