# Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVE-2026-77596)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-rjr3-43j3-4q8g) · 2026-11-09 · Security
Page: https://themorning.dev/story/kubeflow-pipelines-api-server-lacks-authorization-for-shared-pipeline-uploads-cv-19e26d4c7fd5ccb4
Kind: security · Impact: medium

## In brief

- The Kubeflow Pipelines API server performs no authorization on its HTTP multipart upload endpoints when the target namespace is shared, in multi-user mode.
- The affected endpoints are POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/uploadversion.
- The issue is tracked as CVE-2026-77596 and was published in the GitHub Advisory Database on 2026-11-09.

## Why it matters

Users of a shared Kubeflow Pipelines deployment may be able to upload pipelines into namespaces they should not have access to.

## CVEs

- CVE-2026-77596

## Timeline

- 2026-11-09: Vulnerability published in the GitHub Advisory Database (GHSA-rjr3-43j3-4q8g)

## Coverage

- [Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVE-2026-77596)](https://github.com/advisories/GHSA-rjr3-43j3-4q8g) — GitHub Advisory Database, 2026-11-09

Tags: kubeflow, kubeflow-pipelines, authorization, vulnerability, multi-tenancy, mlops

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev