Database/AI/ML frameworks & serving
Kubeflow Pipelines: any authenticated user can modify or delete shared pipelines without RBAC
Impact
In a multi-user Kubeflow install, the API server treats the empty namespace that marks shared or global pipelines as an authorization exception on write paths. Any authenticated user - a data scientist with a single namespace, not a cluster admin - can edit or delete the shared pipeline definitions and versions that other teams run, which breaks integrity and availability of the fleet's training and inference workflows. Because a modified pipeline is later executed by whoever runs it, a tampered definition becomes code running on GPU nodes under someone else's service account. Read access to shared pipelines is intentional and single-user deployments intentionally skip the multi-user checks, so only multi-user clusters are exposed.
Who can reach it
Any authenticated Kubeflow user with access to the multi-user API server. No cluster-level RBAC permission on the shared namespace is needed - that is the bug.
What to do
Upgrade Kubeflow Pipelines to 2.16.1 and restart the API server deployment; no node drain or GPU downtime is involved. Note that the advisory explicitly leaves the shared-pipeline multipart upload authorization path unfixed in 2.16.1, so continue to restrict who can reach that endpoint.
References
Related entries
- llama.cpp (`gguf_init_from_file`): Use of uninitialized heap variableCVE-2024-32878 · llama.cpp (`gguf_init_from_file`)High
- MLflow: basic-auth app leaves tracing and assessment endpoints without permission checksCVE-2025-15381 · MLflow Tracking Server (basic-auth app: tracing and assessment endpoints)High
- vLLM (`MediaConnector` SSRF): SSRF via `load_from_url` in multimodal input handlingCVE-2025-6242 · vLLM (`MediaConnector` SSRF)High
- vLLM (`Nemotron_Nano_VL_Config`): RCE via a config class evaluated at model loadCVE-2025-66448 · vLLM (`Nemotron_Nano_VL_Config`)High
- vLLM: remote media is fully materialized before size and per-prompt limits are enforcedCVE-2026-100650 · vLLM (media acquisition layer, audio_url/base64 chat path, batch speech runner, Rust frontend /tokenize)High
- vLLM: overlong token_ids on the disaggregated serving endpoint crash the workerCVE-2026-100651 · vLLM (disaggregated serving endpoint /inference/v1/generate, decoder prompt-length validation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.