repository icon
kubeflow / kubeflow Project repository

Machine Learning Toolkit for Kubernetes

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN37 DAYS

FIX

WITHINN/A DAYS

RBAC Privilege Escalation via Data Cache Initializer TrainJob Environment Variab...
galanzi2580-wq
self closed
IDOR in Central Dashboard: get-all-namespaces and get-contributors Endpoints Lac...
galanzi2580-wq
self closed
Server-Side Request Forgery in Kubeflow Hub HuggingFace Runtime Catalog Provider...
galanzi2580-wq
self closed
Missing Namespace Authorization on GET /api/namespaces Leaks All Cluster Namespa...
galanzi2580-wq
self closed
Path traversal in loadYamlModelNames leads to unauthenticated arbitrary file rea...
k4lif1
self closed
Path traversal in loadYamlModelNames leads to unauthenticated arbitrary file rea...
k4lif1
self closed
test
k4lif1
self closed
test
k4lif1
self closed
Missing authorization across multiple apiserver handlers allows cross-tenant pod...
ctrexs
self closed
SSRF via Pipeline Creation URL Fetching Allows Cloud Metadata and Internal Servi...
mscgo
self closed
SQL Injection via Forged Page Token in List API Endpoints
p0her
pending
Credentials Exposure in Artifact Metadata
rezaduty
pending
MLMD Filter Query Injection
rezaduty
pending
Path Traversal in Blob Download
rezaduty
pending
Remote Code Execution via OCI Artifact URI Command Injection
rezaduty
pending
SQL Injection via Metric Sort Field
rezaduty
duplicate
High
Server-Side Request Forgery in CreatePipeline API
rezaduty
duplicate
High
Remote Code Execution via Tar Slip Path Traversal in KFP SDK Extraction Helpers
unicuervo16
pending
Broken Access Control in Central Dashboard leading to Multi-User Isolation Bypas...
sebas5207418
pending
Remote Code Execution via eval() in Kubeflow Pipelines Visualization Server
galanzi2580-wq
pending
Privilege Escalation via Missing Authorization Logic
jeremylaratro
pending
Kubeflow Trainer S3 Initializer Path Traversal Vulnerability
mia-718ai
pending
KFAM CreateProfile API Missing Authorization - Arbitrary Kubeflow Namespace Crea...
mia-718ai
pending
Kubeflow KFAM Authentication Bypass: HTTP Header Spoofing Allows Arbitrary User...
mia-718ai
pending
Arbitrary Command Execution via Unvalidated Parameter Injection in Katib Trial T...
mia-718ai
pending
Kubeflow Profile Controller Authorization Bypass Allows Cloud IAM Privilege Esca...
mia-718ai
pending
Missing Authorization in ReadBinding API Allows Cross-Tenant User Enumeration
cr-itamarhershko
pending
SQL Injection
hexflowsec
pending
Critical Chained SSRF / RCE in Kubeflow Pipelines Visualization Service (Unauth...
doctormen
pending
PostCSS Build Failure on Windows Due to Unquoted Paths with Spaces
7908837174
pending
Supply Chain Attack Vector in Kubeflow Development Setup
7908837174
pending
Regular expression Denial of Service - ReDoS
codevigilanteofficial
High
•$750•CVE-2024-5552
External HTTP Interaction
danmcinerney
High
•CVE-2023-6570
XSS in /pipelines/artifacts/get
danmcinerney
Medium
•CVE-2023-6571
huntr: kubeflow/kubeflow