Threats tagged 'ghsa-ghgh-57qv-h687'

Kubeflow Pipelines in multi-user mode had an authorization bypass vulnerability allowing any authenticated user to modify or delete shared/global pipelines without proper Kubernetes RBAC permissions. This flaw affected write and delete operations on pipelines with an empty namespace. The issue was fixed in version 0.0.0-20260420170029-186dd1f3b040. Unauthorized modifications could compromise pipeline integrity and unauthorized deletions could disrupt availability. Reading shared pipelines was always allowed and remains so after the fix. The vulnerability does not directly enable code execution but could lead to attacker-controlled workload behavior if a modified pipeline is executed.