Improper Access Control in Kubeflow Pipelines by Google

CVE-2026-77596

What is CVE-2026-77596?

Prior to version 2.18.0, Kubeflow Pipelines exhibited an improper access control vulnerability that allowed low-privilege users to bypass security measures. Specifically, users could exploit multi-user HTTP endpoints to upload or inject versions of shared pipelines without appropriate permissions when the target namespace was empty. If the API server was reachable without authentication, even unauthenticated users could leverage this bypass, exposing deployments to risk. The issue has been rectified in version 2.18.0, ensuring enhanced security for all users.

References