Kubeflow Pipelines: Missing Authorization on Shared Pipeline Uploads Enables Supply-Chain Tampering (CVE-2026-77596)

What happened

A GitHub Security Advisory (GHSA-rjr3-43j3-4q8g) discloses a critical authorization bypass in Kubeflow Pipelines, tracked as CVE-2026-77596 (CVSS 9.6, exploit PoC publicly available). According to the advisory, in multi-user mode the API server's HTTP upload endpoints (POST /apis/v2beta1/pipelines/upload and /upload_version) skip authorization whenever the target namespace is empty — which is the default representation for shared, cluster-wide pipelines. The advisory states the authorization helper canUploadVersionedPipeline returns early without performing a SubjectAccessReview in this case, while the equivalent gRPC path correctly authorizes the same write. The advisory includes a reproduced PoC showing a low-privilege (or even unauthenticated, if the API server is directly reachable) caller creating shared pipelines and injecting new pipeline versions without the required permission.

Why it matters

Per the advisory, this affects any Kubeflow Pipelines multi-user deployment running version 2.17.3 or earlier that permits shared pipelines (the default REQUIRE_NAMESPACE_FOR_PIPELINES=false config ships unset in all manifests). The impact described goes beyond catalog tampering: if an existing recurring run is configured to follow the latest version of a shared pipeline (rather than pinned), the advisory notes the scheduler will automatically pick up an attacker-injected version on its next run and execute it under the victim workload's namespace and service account — with no further user interaction. The advisory frames this as a source-verified execution path, though it notes an end-to-end scheduled-execution PoC was not performed as part of the maintainer assessment. This is a supply-chain-style risk: a low-privilege tenant could potentially compromise data and workloads belonging to other tenants sharing the cluster.

What defenders should watch for / do now

• Identify any Kubeflow Pipelines multi-user deployments and check the version against the advisory's affected range (<= 2.17.3); the fix ships in 2.18.0.
• As an interim mitigation noted in the advisory, operators can set REQUIRE_NAMESPACE_FOR_PIPELINES=true to reject empty-namespace pipeline operations until upgraded.
• Audit existing shared pipelines and their version history for unexpected or attacker-controlled uploads, especially any versions added without a corresponding authorized change.
• Review recurring runs that consume shared pipelines — specifically those not pinned to a specific version — since the advisory indicates these are the automatic-execution risk path. Pin critical recurring runs to a reviewed version.
• Audit logs for upload requests to /pipelines/upload or /pipelines/upload_version with no namespace parameter and no corresponding authorization/SubjectAccessReview log entry, and for uploads from identities lacking expected pipeline-write RBAC.
• After upgrading, explicitly pass tenant namespaces in SDK/API calls (e.g., client.upload_pipeline(..., namespace=...)), since the advisory notes namespace is not inherited automatically from client configuration.

Developing intel

This advisory was published 2026-11-09 and is still marked as a maintainer draft pending final publication per the source; details such as scope of real-world exploitation are not yet established beyond the reproduced PoC. Treat this writeup as a snapshot of currently available information and consult the original advisory for updates: GHSA-rjr3-43j3-4q8g.