Kubeflow Pipelines server-side request forgery and authorization bypass flaws
Internal information can leak and pipeline work can be tampered with in this machine learning tool!
Summary
Several flaws in Kubeflow Pipelines let an attacker read internal resources or tamper with other tenants' pipelines and cached results. Versions before 2.18.0 are affected.
Affected when
- Standalone install with authorization disabled (default setting)
- Multi-user setup with a low-privilege tenant account
- Environment where cloud metadata services are reachable
What to do
Update to 2.18.0 or later.
Products and platforms
CVE IDs
Sources
Times
First published
First seen