kubeflow
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 28 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 14, 2023 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
Monitor kubeflow in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.