CVE-2026-118759: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Severity: high. ## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or a

Читать первоисточник →