CVE-2026-77596

Prior to version 2.18.0 , the Kubeflow Pipelines API server is vulnerable to an authorization bypass in the canUploadVersionedPipeline function. This occurs because the system fails to perform a SubjectAccessReview when the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES is set to i...