Kubeflow Pipelines before version 2.16.1 mistakenly treats the empty namespace used for shared or global pipelines as an exception in multi‑user API server authorization checks, allowing any authenticated user to perform modification or deletion operations on those pipelines. This flaw constitutes an authorization bypass (CWE‑285), an access control weakness (CWE‑863), and involves an improper authentication weakness (CWE‑281), compromising the integrity and availability of shared workflows. A compromised pipeline can alter end‑to‑end machine‑learning experiments or disrupt services that rely on them. The defect does not affect read‑only access intentionally, and the separate multipart upload path for shared pipelines is not covered by this fix.

The vulnerability affects Kubeflow Pipelines deployments using versions earlier than 2.16.1. The flaw specifically targets the global pipeline namespace, which is shared across users in a multi‑user cluster. Any instance that relies on the default empty namespace for shared pipelines is exposed until a patch or upgrade is applied.

The CVSS score of 7.2 indicates a high severity, and an EPSS score of 0.0031 shows a very low but non‑zero probability of exploitation. The lack of KEV listing suggests that no widespread exploitation has been observed yet. Nonetheless, the vulnerability can be exploited by any authenticated user in the cluster, making it a serious threat to any organization that uses shared pipelines without enforcing stricter RBAC controls.