CVE-2026-47237: Kubeflow Auth Bypass Vulnerability

CVE-2026-47237 Overview

CVE-2026-47237 affects Kubeflow Community Distribution, the packaging project that helps users install the Kubeflow Platform on Kubernetes clusters. Versions prior to 26.03-rc.1 allow authorization token theft from any user of the Kubeflow UI or APIs, including the Dashboard, Pipelines API, and Notebooks. An attacker who holds the kubeflow-edit (Contributor) role in any Kubeflow namespace can capture tokens belonging to other users. This condition is satisfied by default when Automatic Profile Creation is enabled. Successful exploitation results in full account takeover and access to victim data. The weakness maps to [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Authenticated low-privilege users can steal authorization tokens from other Kubeflow users, leading to account takeover and unauthorized access to machine learning pipelines, notebooks, and data.

Affected Products

Kubeflow Community Distribution versions prior to 26.03-rc.1
Kubeflow setups based on the official manifests
Most packaged Kubeflow distributions derived from the community manifests

Discovery Timeline

2026-07-21 - CVE-2026-47237 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47237

Vulnerability Analysis

Kubeflow deploys workloads inside per-user namespaces called Profiles. Users interact with services such as the Central Dashboard, Pipelines API, and Notebooks through authenticated sessions that carry authorization tokens. In vulnerable versions, a user with the kubeflow-edit role in any namespace can create or modify resources that intercept requests or read credentials belonging to other users routed through shared components. The result is cross-tenant token disclosure inside a platform that assumes namespace boundaries enforce isolation. Because the kubeflow-edit role is automatically granted when Automatic Profile Creation is enabled, default deployments expose the primitive required to launch the attack.

Root Cause

The root cause is incorrect privilege assignment within the manifests that ship with Kubeflow Community Distribution. Namespace-scoped Contributor permissions permit actions whose effects cross tenant boundaries. Requests and tokens processed by shared control-plane components can be captured from a namespace controlled by an attacker with the kubeflow-edit role. This violates the least-privilege model implied by the multi-tenant Profile architecture.

Attack Vector

The attack requires network access to the Kubeflow UI or APIs and authenticated credentials for a valid Kubeflow user with the Contributor role in one namespace. The attacker deploys or configures a resource within their own Profile namespace to observe traffic or credentials belonging to victim users. When victims interact with Kubeflow services, their authorization tokens become available to the attacker. The attacker then replays the token to impersonate the victim across the Dashboard, Pipelines API, and Notebooks.

No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-v824-8gxh-pgjw and the corresponding GitHub Pull Request.

Detection Methods for CVE-2026-47237

Indicators of Compromise

Unexpected creation of resources by Contributor-role users in Profile namespaces that reference cross-namespace services or shared control-plane endpoints.
Kubeflow Dashboard, Pipelines, or Notebooks API calls originating from an IP or user agent that does not match the legitimate user's historical pattern.
Authentication tokens observed in use from multiple source identities within a short time window.

Detection Strategies

Audit Kubernetes RBAC bindings to enumerate every principal holding the kubeflow-edit role and confirm whether Automatic Profile Creation is enabled.
Review Kubernetes audit logs for create, update, or patch actions performed by Contributor-role users on resources that touch ingress, service accounts, or webhook configurations.
Correlate Kubeflow application logs with Kubernetes API server logs to identify token reuse from unexpected namespaces or pods.

Monitoring Recommendations

Enable Kubernetes API server audit logging at the Metadata level or higher across all Kubeflow namespaces.
Forward Kubeflow component logs (Dashboard, Pipelines, Notebook Controller) to a centralized SIEM for authorization-event correlation.
Alert on any privilege change that grants kubeflow-edit or equivalent Contributor permissions outside of provisioned onboarding workflows.

How to Mitigate CVE-2026-47237

Immediate Actions Required

Upgrade Kubeflow Community Distribution to version 26.03-rc.1 or later, which contains the fix.
Disable Automatic Profile Creation until the upgrade is completed to prevent unvetted users from receiving the kubeflow-edit role.
Rotate all Kubeflow user authorization tokens and session credentials after patching.
Review Profile namespaces created before the patch for unexpected resources planted by low-privilege users.

Patch Information

The fix is delivered in Kubeflow Community Distribution 26.03-rc.1. Review the remediation in the upstream commit 31b2411 and the merged Pull Request #3043. Additional context is published in the GitHub Security Advisory GHSA-v824-8gxh-pgjw.

Workarounds

Disable Automatic Profile Creation and require administrator approval before granting the kubeflow-edit role in any namespace.
Restrict network access to the Kubeflow Dashboard, Pipelines API, and Notebooks endpoints to trusted identities using an ingress-level authentication proxy.
Apply Kubernetes NetworkPolicies that prevent Profile-namespace workloads from reaching shared Kubeflow control-plane services except through approved paths.

bash

# Configuration example: identify principals holding the kubeflow-edit role
kubectl get rolebindings,clusterrolebindings --all-namespaces -o json \
  | jq '.items[] | select(.roleRef.name=="kubeflow-edit") | {namespace: .metadata.namespace, name: .metadata.name, subjects: .subjects}'

# Disable Automatic Profile Creation in the Kubeflow profiles configuration
kubectl -n kubeflow set env deployment/profiles-deployment \
  USERID_HEADER=kubeflow-userid \
  USERID_PREFIX= \
  AUTO_CREATE_PROFILE=false