Database/AI/ML frameworks & serving
Kubeflow Pipelines: execution cache keys ignore namespace, letting tenants read or poison each other's cached outputs
Impact
In multi-user Kubeflow Pipelines deployments where tenant namespaces share the cache service, the legacy V1/raw-Argo cache hashes template fields without the namespace and trusts a mutable annotation when publishing outputs. A tenant who can submit workloads can read another namespace's cached step outputs, or seed outputs that get substituted into a later step of someone else's pipeline. On a shared ML platform that means cross-tenant data disclosure and tampering with another team's training or data-prep results. Standard KFP V2 component pods bypass this cache. Code execution and availability impact are not established.
Who can reach it
Authenticated tenant with workload-submission privileges in any namespace of a multi-user KFP deployment that shares the cache service. Matching requires the selected template fields and staleness policy to line up.
What to do
Upgrade Kubeflow Pipelines to 2.18.0, which rolls out new cache-server and mutating webhook deployments. Single-tenant deployments and pipelines that run only standard V2 component pods are not exposed to the cross-namespace path. Previously cached outputs from before the upgrade may already have been read or seeded. The record does not say how to audit them.
References
Related entries
- TorchServe (model/workflow API): Information disclosure of files on the serving hostCVE-2023-48299 · TorchServe (model/workflow API)Medium
- llama.cpp (RPC backend): Arbitrary address read via `rpc_tensor.data`CVE-2024-42478 · llama.cpp (RPC backend)Medium
- HuggingFace transformers: ReDoS in `convert_tf_weight_name_to_pt_weight_name`CVE-2025-5197 · HuggingFace transformersMedium
- mcp-kubernetes-server: chained kubectl commands bypass the read-only --disable-write/--disable-delete guardsCVE-2025-59376 · feiskyer mcp-kubernetes-server (--disable-write / --disable-delete command guards)Medium
- Hugging Face Transformers: ReDoS in the English number normalizer burns CPU on crafted inputCVE-2025-6051 · Hugging Face Transformers (EnglishNormalizer.normalize_numbers)Medium
- vLLM: catastrophic regex backtracking in several request paths lets a caller burn API-server CPUCVE-2025-71379 · vLLM (LoRA utils, phi4mini tool parser, OpenAI-compatible chat endpoint regexes)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.