Kubeflow Pipelines suffers from a missing namespace authorization check in its frontend artifact routes. From version 0.5.1 up to 2.17.0, any authenticated user who can reach the frontend and knows the artifact location can specify an arbitrary namespace or omit the namespace entirely. This allows the user to read artifact contents—including datasets, trained models, or pipeline outputs—belonging to other tenants. The vulnerability does not grant access to Kubernetes Secrets, write capabilities, or server‑side code execution; it is strictly a data disclosure flaw.

The affected product is Kubeflow Pipelines, with all releases from 0.5.1 through 2.17.0 installed in a multi‑user configuration. Deployments that rely on Kubeflow’s built‑in tenant isolation are susceptible. Version 2.17.0 contains the fix and is the earliest patched release.

The CVSS score of 6.5 reflects moderate complexity; the EPSS score is not provided, and the issue is not listed in CISA KEV. The attack requires only that the attacker be an authenticated user who can reach the frontend and possess knowledge of an artifact URI. The attacker can then craft a request with a different namespace or no namespace to retrieve the artifact, thereby compromising confidentiality across tenants.