EUVD-2026-117830Published
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-77596 · CVE overview and exploitation status
cve-program · CVE-2026-77596
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g
- https://github.com/kubeflow/pipelines/pull/14352
- https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
euvd · EUVD-2026-117830
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g
- https://github.com/kubeflow/pipelines/pull/14352
- https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
nvd · CVE-2026-77596
- https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841
- https://github.com/kubeflow/pipelines/pull/14352
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g
osv · GHSA-rjr3-43j3-4q8g
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g
- https://nvd.nist.gov/vuln/detail/CVE-2026-77596
- https://github.com/kubeflow/pipelines/pull/14352
- https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841
- https://github.com/kubeflow/pipelines
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
Related changes
Linked by CVE identifier- Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canU… · Advisory content revised · 11 Nov 2026
- Kubeflow Pipelines API server lacks authorization for shared pipeline uploads · Newly collected advisory · 9 Nov 2026
- Kubeflow Pipelines API server lacks authorization for shared pipeline uploads · Newly collected advisory · 5 Nov 2026