kubeflow pipelines.

Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)

• kubeflow pipelines
• Broken access control
• CWE-345

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

• kubeflow pipelines
• Broken access control

Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints

• kubeflow pipelines
• Server-side request forgery (SSRF)

Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

• kubeflow pipelines
• Server-side request forgery (SSRF)

Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy

• kubeflow pipelines
• Hard-coded credentials
• Server-side request forgery (SSRF)

Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

• kubeflow pipelines
• Broken access control

Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses

• kubeflow pipelines
• Cross-site scripting (XSS)

Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server

• kubeflow pipelines
• SQL injection

Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation

• kubeflow pipelines
• Server-side request forgery (SSRF)
• CWE-441

Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads

• kubeflow pipelines
• Broken access control

Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source

• kubeflow pipelines
• Path traversal

Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true

• kubeflow pipelines
• Broken access control
• Server-side request forgery (SSRF)