---
id: CVE-2026-118760
title: >-
  Kubeflow Pipelines: Missing namespace authorization permits cross-tenant
  artifact reads
summary: >-
  Kubeflow Pipelines enables users to build and deploy portable, scalable
  machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact
  routes did not check whether an authenticated user was authorized to access
  the requested …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
  - CWE-862
vendor: kubeflow
product: pipelines
affected:
  - pipelines < 2.17.0
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T16:35:05.192Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118760'
references:
  - url: >-
      https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj
    label: >-
      https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj
  - url: 'https://github.com/kubeflow/pipelines/issues/9889'
    label: 'https://github.com/kubeflow/pipelines/issues/9889'
  - url: 'https://github.com/kubeflow/pipelines/pull/12860'
    label: 'https://github.com/kubeflow/pipelines/pull/12860'
  - url: >-
      https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba
    label: >-
      https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba
  - url: 'https://github.com/kubeflow/pipelines/releases/tag/2.17.0'
    label: 'https://github.com/kubeflow/pipelines/releases/tag/2.17.0'
tags:
  - cve.org
epss: 0.00352
epssPercentile: 0.28826
ingestedAt: '2026-11-01T21:01:32.734Z'
---

## Overview

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.

## Affected

- `pipelines < 2.17.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.