Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-05T23:17:01.600Z",
  "pubdate": "2026-11-05T23:17:01.600Z",
  "executiveSummary": "Kubeflow Pipelines versions prior to 2.18.0 contain a critical vulnerability in the legacy V1/raw-Argo execution cache mechanism. This flaw stems from a lack of namespace-aware isolation in cache lookups and storage path hashing, combined with an over-reliance on the mutable pipelines.kubeflow.org/execution_cache_key annotation.\nIn multi-tenant environments where distinct namespaces utilize a shared cache service, a malicious actor possessing standard workload-submission privileges can perform cache poisoning or unauthorized data retrieval. By manipulating the execution cache key or exploiting the lack of namespace scoping, an attacker can substitute malicious outputs into subsequent pipeline steps or intercept sensitive cached results belonging to other tenants.\nThis vulnerability compromises the integrity and confidentiality of machine learning workflows. While arbitrary code execution and direct service availability impacts are not established, the ability to inject falsified outputs into automated pipelines presents significant security risks in shared Kubernetes environments. Exploitation requires only the ability to submit workloads within a tenant namespace, making this a high-risk concern for shared KFP deployments.",
  "technicalDetails": "The vulnerability resides within the legacy V1/raw-Argo execution cache mutating webhook and the associated cache-server storage logic. The root cause is the omission of the Kubernetes namespace identifier during the computation of cache path hashes and during lookup operations. Consequently, the cache-server treats the execution key as a global identifier rather than a scoped resource, allowing cross-namespace cache collisions.\nThe attack vector involves a tenant leveraging workload-submission privileges to influence the mutable 'pipelines.kubeflow.org/execution_cache_key' annotation. Because the system trusts this annotation when publishing outputs, an attacker can manually specify a key corresponding to a target pipeline step in a different namespace. If the attacker triggers an execution that utilizes the same key before the legitimate user, the cache-server stores the attacker-provided output.\nThe attack flow follows these steps: 1) An attacker identifies a target workflow or pipeline component in a separate namespace that relies on cached execution results. 2) The attacker crafts a malicious payload or output artifact intended to replace the legitimate output. 3) The attacker submits a workload in their own namespace, applying the 'pipelines.kubeflow.org/execution_cache_key' annotation to match the key of the targeted legitimate step. 4) The cache-server, lacking namespace validation, accepts the attacker's output as the authoritative result for that key. 5) When the legitimate workflow executes the subsequent step, the system retrieves the attacker-injected artifact from the cache, resulting in unauthorized data access or the injection of malicious inputs into the target pipeline.\nThis vulnerability is limited to the legacy V1/raw-Argo implementation; standard KFP V2 component pods are inherently immune as they bypass this flawed caching mechanism. The issue persists across all versions prior to 2.18.0. Successful exploitation does not require administrative privileges, merely the capacity to submit workloads within the cluster. The lack of namespace-based isolation prevents the system from distinguishing between legitimate tenant data and malicious cross-tenant injection attempts."
}