Kubeflow Pipelinesで他テナントに不正実行、修正版あり
Summary
Kubeflow Pipelinesのマルチユーザー構成で、低権限の利用者が共有パイプラインへ不正な版を差し込み、他テナントの実行に紛れ込ませられます。2.18.0未満なら修正版へ更新し、API serverの公開範囲と定期実行の設定も見直してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Kubeflow Pipelinesのマルチユーザー構成で、低権限の利用者が共有パイプラインへ不正な版を差し込み、他テナントの実行に紛れ込ませられます。2.18.0未満なら修正版へ更新し、API serverの公開範囲と定期実行の設定も見直してください。
Original description The description as published by the source.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.
Source: CVE.org (CVE Program・cvelistV5) NVD