CVE-2026-77596

Kubeflow shared uploads can replace another tenant’s pipeline

Kubeflow · Kubeflow Pipelines API server

First documented disclosure · Review checkpoint

Summary

An unprivileged tenant can add a version to a shared pipeline without write permission.

Severity and exploitation evidence

Critical · 9.6/10 · CVSS 3.1. Severity source.

Exploitation not established: Live upload bypass was reproduced. The automatic recurring-run path was source-verified, not an end-to-end victim execution. No malicious deployment is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Multipart upload authorization returns early for an empty namespace, unlike the protected shared-write API path.

Conditions required

Multi-user deployment permits shared pipelines; attacker reaches upload endpoints. Automatic execution additionally needs a compatible unpinned recurring run using that pipeline.

Potential impact

Unauthorized shared versions can run with a consuming workload’s service account and data access; cluster-admin access is not implied.

Affected versions and configurations

Released KFP versions through 2.17.3, per the maintainer.

Fix and mitigation status

2.18.0 authorizes shared uploads against the system namespace.

Practical next steps

Upgrade server and manifests; use explicit tenant namespaces in clients, review shared versions and schedules, and pin runs to reviewed versions. The patch does not remove earlier malicious versions.

Operating lesson

Treat shared pipeline versions as executable supply-chain inputs.

Evidence and limits

September 9 public patch; October 28 advisory/release; November 5 CVE. Direct exposure without an authenticating proxy can also permit anonymous uploads. The separate 2.16.1 shared-write fix does not cover this upload path.

Sources