Kubeflow Pipelines API server versions before 2.18.0 decompress uploaded pipeline archives without sufficiently bounding the expanded size. A small, specially crafted ZIP or gzip-compressed tar archive can consume large amounts of memory and exhaust API server resources. Because decompression happens before namespace authorization, any caller that can reach the upload endpoint can trigger it without valid credentials.
Kubeflow · Kubeflow Pipelines
Kubeflow Pipelines before 2.18.0 does not check whether the caller may access a run before returning its pod logs through the API server's run log endpoint. An attacker who can reach the API server and knows a run ID and a suitable pod or node identifier can read live or archived logs with the API server's permissions. Because the live log path also accepts the node ID as a pod name without verifying the run, a known run ID can be used to read logs of an unrelated pod in another namespace. Exposed logs may contain sensitive workload data or credentials.
Kubeflow · Pipelines
Kubeflow Pipelines before 2.18.0 does not restrict the file path supplied to the GET /artifacts/get?source=volume route to the selected volume. An attacker who can reach this route and knows the name of an existing mounted volume can read files outside that volume, as far as the artifact-serving process has read access. With authentication disabled, no credentials are required; in multi-user deployments the caller normally must be authorized for the requested namespace. The impact is limited to confidentiality.
Kubeflow · Pipelines
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery (SSRF) vulnerability in the InferenceService controller, which processes the modelregistry.kubeflow.org/url annotation. An authenticated user with access to a namespace can point this annotation at an attacker-controlled server, causing the controller to send its ServiceAccount bearer token there. With the stolen token, the attacker can modify other tenants' InferenceServices cluster-wide.
Kubeflow · Model Registry
