CVE-2026-77596: Cross-Tenant Authorization Bypass in Kubeflow Pipelines Upload API

Vulnerability ID: CVE-2026-77596
CVSS Score: 9.6
Published: 2026-11-09

CVE-2026-77596 is an authorization bypass vulnerability in the Kubeflow Pipelines API server affecting multi-user deployments prior to version 2.18.0. The HTTP multipart upload handlers prematurely terminate authorization checks and return success when the target namespace parameter is empty or omitted. Because the default configuration allows pipelines without namespaces to function as cluster-wide shared resources, any low-privileged tenant can create shared pipelines or inject arbitrary pipeline versions into existing shared pipelines without undergoing Kubernetes SubjectAccessReview validation. When other tenants execute unpinned recurring runs tracking these shared pipelines, the attacker-supplied workload runs inside the victim tenant's namespace using the victim's service account credentials.

TL;DR

An authorization bypass in the Kubeflow Pipelines HTTP upload endpoints (CVE-2026-77596) allows low-privileged tenants to create or modify cluster-wide shared pipelines by omitting the namespace parameter, enabling cross-tenant code execution when victim tenants run unpinned scheduled workflows.

Technical Details

  • CVE ID: CVE-2026-77596 (GHSA-rjr3-43j3-4q8g)
  • CWE Classification: CWE-639 (Authorization Bypass Through User-Controlled Key) / CWE-862 (Missing Authorization)
  • CVSS v3.1 Score: 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
  • EPSS Score: 0.25% (16.47th Percentile)
  • Attack Vector: Network via HTTP multipart upload API (/apis/v2beta1/pipelines/upload & /upload_version)
  • Security Impact: Cross-tenant arbitrary workflow execution and service account compromise
  • Exploit Status: No public weaponized exploit; straightforward to trigger via standard HTTP clients
  • CISA KEV Status: Not Listed

Affected Systems

  • Kubeflow Pipelines (ml-pipeline API server)
  • Kubeflow Pipelines: < 2.18.0 (Fixed in: 2.18.0)

Code Analysis

Commit: 62516d8

Enforce SubjectAccessReview in the KFP system namespace when uploading shared pipelines or versions with empty namespaces.

File: backend/src/apiserver/server/pipeline_upload_server.go @@ -401,8 +401,9 @@ func (s *PipelineUploadServer) canUploadVersionedPipeline(r *http.Request, pipel resourceAttributes.Namespace = namespace } } - if resourceAttributes.Namespace == "" { - return nil + if s.resourceManager.IsEmptyNamespace(resourceAttributes.Namespace) { + // Shared-pipeline writes require authorization in the KFP system namespace. + resourceAttributes.Namespace = common.GetPodNamespace() } resourceAttributes.Group = common.RbacPipelinesGroup

Mitigation Strategies

  • Upgrade Kubeflow Pipelines backend components to version 2.18.0 or later to enforce SubjectAccessReview in the system namespace for shared pipeline uploads.
  • Enforce mandatory namespace bindings on all pipelines by configuring REQUIRE_NAMESPACE_FOR_PIPELINES=true in the ml-pipeline API server deployment.
  • Pin all recurring runs (ScheduledWorkflows) to immutable pipeline_version_id values rather than relying on dynamic resolution of the latest shared pipeline version.
  • Restrict direct network access to the ml-pipeline API server service using Kubernetes NetworkPolicies and Istio AuthorizationPolicies to ensure all requests pass through an authenticating proxy.

Remediation Steps:

  1. Update the ml-pipeline API server deployment image to version 2.18.0 or a build containing commit 62516d8c525f146b754cb515cf441dd0290ad841.
  2. If unable to upgrade immediately, edit the ml-pipeline Deployment in the kubeflow namespace to add the environment variable REQUIRE_NAMESPACE_FOR_PIPELINES set to 'true' and restart the pods.
  3. Query the Kubeflow Pipelines relational database (pipeline_versions and pipelines tables) to identify any versions attached to namespace-less pipelines that were uploaded by non-admin tenants.
  4. Review all active ScheduledWorkflow custom resources across tenant namespaces and verify that spec.workflowSpec.pipelineVersionId is explicitly pinned to a trusted version.

References

Read the full report for CVE-2026-77596 on our website for more details including interactive diagrams and full exploit analysis.