https://insinuator.net/tags/kubeflow/ Recent content in Kubeflow on Insinuator.net - Bold Statements Hugo en-us Wed, 20 May 2026 00:00:00 +0000 https://insinuator.net/2026/05/cve-2026-47237-overly-permissive-istio-permissions-allow-kubeflow-authorization-token-stealing/ Wed, 20 May 2026 00:00:00 +0000 https://insinuator.net/2026/05/cve-2026-47237-overly-permissive-istio-permissions-allow-kubeflow-authorization-token-stealing/ <p>Kubeflow is vulnerable to the theft of authorization tokens by any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user&rsquo;s account and the data that is processed by that user. The attacker needs a valid user with the <code>kubeflow-edit</code> or Contributor role in a random Kubeflow namespace to perform this attack. This is given if <em>Automatic Profile Creation</em> is enabled. A setup based on the official manifests prior to version 1.10, and on most other packaged Kubeflow distributions, is vulnerable.</p> <p>The Istio edit permissions were removed by Kubeflow in a timely manner. Affected users should update to the latest version to mitigate this issue.</p>