Read the docs
TI-2026-34822 Aliases CVE-2026-47237

Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing

Priority HIGH 70CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the ``kubeflow-edit`` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed community-distribution (kubeflow): 26.03-rc.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kubeflowcommunity-distributionbefore 26.03-rc.126.03-rc.1Patch availableCNA
  • community-distribution Vendorkubeflow Affected before 26.03-rc.1 Fixed in 26.03-rc.1 Patch available CNA

Remediation

  • Fix · CNA community-distribution (kubeflow) Fixed in 26.03-rc.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47237

References

Other 3

  • TI-2026-39556 Improper access control in kubeflow pipelines CVSS 3.1CRITICAL 10.0
  • TI-2024-05160 ReDoS in kubeflow/kubeflow CVSS 3.1HIGH 7.5
  • TI-2026-85696 Server-side request forgery in Kubeflow Pipelines TensorBoard proxy CVSS 3.1MEDIUM 5.8
  • TI-2026-73437 Server-side request forgery in Kubeflow Model Registry leaks tokens CVSS 4.0HIGH 7.1
  • TI-2026-85698 Server-side request forgery in Kubeflow Pipelines artifact endpoints CVSS 3.1HIGH 8.6
  • TI-2026-85695 Kubeflow Pipelines API server skips authorization for shared pipeline uploads CVSS 3.1CRITICAL 9.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences