Kubeflow Pipelines RBAC bypass lets users modify or delete shared pipelines
Anyone logged in to Kubeflow Pipelines can change or delete shared workflows.
Summary
The multi-user API server of Kubeflow Pipelines skips authorization checks when shared pipelines are modified or deleted, so any logged-in user can change or remove them. Versions before 2.16.1 are affected.
Affected when
- Multi-user deployment (not single-user)
- Attacker has a login account
What to do
Update to 2.16.1 or later. The shared-pipeline multipart upload authorization path is not fixed by this version; check the official advisory.
Products and platforms
CVE IDs
Times
First published
First seen