International
The Morning Dev

Only the news worth knowing

‹
 

SecurityFan score 42 · Tier B

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVE-2026-77596)

GitHub Advisory Database ·

The Brief

  • The Kubeflow Pipelines API server performs no authorization on its HTTP multipart upload endpoints when the target namespace is shared, in multi-user mode.
  • The affected endpoints are POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/uploadversion.
  • The issue is tracked as CVE-2026-77596 and was published in the GitHub Advisory Database on 2026-11-09.

Why it matters

Users of a shared Kubeflow Pipelines deployment may be able to upload pipelines into namespaces they should not have access to.

Who’s affected

  • Teams running Kubeflow Pipelines in multi-user mode

Affects github.com/kubeflow/pipelines. Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints (POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/uploadversion) perform no authorization when the target namespace is…

Read the full story at github.com ↗

Timeline

  1. Vulnerability published in the GitHub Advisory Database (GHSA-rjr3-43j3-4q8g)

  2. GitHub Advisory Database

    Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVE-2026-77596)

How do you feel about this?

0 Comments

    Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVE-2026-77596) – The Morning Dev