Database/AI/ML frameworks & serving
Kubeflow Pipelines: frontend artifact routes skip namespace authorization, exposing other tenants' artifacts
Impact
The Kubeflow Pipelines frontend authenticates the caller at ingress but never checks that they are authorized for the namespace named in an artifact request. Any authenticated user who knows or guesses an artifact location can select another tenant's namespace - or omit the namespace entirely and hit an unguarded direct handler - and read datasets, trained models and pipeline outputs belonging to other teams. On a shared GPU cluster where Kubeflow namespaces are the tenancy boundary, this is a straight cross-tenant read of training data and model weights. The advisory is explicit that it does not give arbitrary Secret disclosure, storage writes, or code execution. Versions 0.5.1 up to 2.17.0.
Who can reach it
Any user authenticated to the Kubeflow Pipelines frontend in a multi-user deployment. No membership in the target namespace is needed.
What to do
Upgrade Kubeflow Pipelines to 2.17.0 and roll the frontend deployment - a standard pod rollout, no node disruption. Where the upgrade has to wait, restrict frontend access and do not rely on KFP namespace isolation for artifact confidentiality.
References
Related entries
- vLLM: unbounded frame count in video/jpeg base64 data URLs crashes the server with OOMCVE-2026-34755 · vLLM OpenAI-compatible API server (video/jpeg base64 multimodal path)Medium
- vLLM: no upper bound on the n parameter lets a single request OOM the API serverCVE-2026-34756 · vLLM OpenAI-compatible API server (ChatCompletionRequest/CompletionRequest n parameter)Medium
- vLLM (revision pinning): Revision pinning does not apply to all model artifactsCVE-2026-47155 · vLLM (revision pinning)Medium
- Starlette: malformed Host header makes request.url.path diverge from the routed pathCVE-2026-48710 · Starlette (Host header validation when reconstructing request.url)Medium
- vLLM - sampling parameter validation: Temperature validation uses strict comparison operators, so boundary values slipCVE-2026-54235 · vLLM - sampling parameter validationMedium
- vLLM: audio input in chat completions skips the decode-duration limit, letting a small clip OOM the workerCVE-2026-57173 · vLLM (input_audio path in /v1/chat/completions, AudioMediaIO decode duration guard)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.