CVE-2026-47237: token theft lets any user hijack

CISO Take

A design flaw in the official Kubeflow Community Distribution manifests allows any authenticated user with the standard kubeflow-edit/Contributor role in their own namespace to steal the authorization tokens of other users of the Dashboard, Pipelines API, or Notebooks, effectively taking over their account and any data or models they can access. This is a low bar to clear: with Automatic Profile Creation enabled — a common, often default configuration on multi-tenant Kubeflow platforms — any new signup automatically gets an edit-capable namespace and thus the prerequisite for this attack, meaning the effective attacker population is every onboarded user, not just admins. There is no CISA KEV listing, no public PoC, and no EPSS score published yet, so this is not being mass-exploited today, but the CVSS 8.0 (network, low complexity, low privileges) reflects that exploitation requires no special tooling once an attacker has any account on the platform. Patch to Kubeflow Community Distribution 26.03-rc.1 or later, and until then disable Automatic Profile Creation and audit which users currently hold kubeflow-edit/Contributor roles, since each one is a viable launch point. Detection teams should review Dashboard, Pipelines API, and Notebook session/token issuance logs for cross-user token reuse or anomalous namespace-to-namespace access.

Sources: NVD CISA KEV GitHub Advisory ATLAS

What is the risk?

High risk for any organization running multi-tenant Kubeflow with Automatic Profile Creation enabled. The prerequisite privilege (kubeflow-edit/Contributor in a self-service namespace) is trivially obtainable by any onboarded user, collapsing the effective attack surface to 'anyone with an account.' Impact is full compromise of confidentiality, integrity, and availability of the victim's session (CVSS C:H/I:H/A:H), including any downstream ML assets, notebooks, and pipeline runs that user can reach. The absence of KEV listing, EPSS score, and public exploit code lowers near-term mass-exploitation likelihood, but the low attack complexity and low privilege requirement mean a targeted insider or a low-privilege compromised account could pivot to admin-level or higher-value user sessions quickly.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege Kubeflow account that receives a kubeflow-edit/Contributor namespace via Automatic Profile Creation.

AML.T0012

Token Theft

Attacker exploits the incorrect privilege assignment (CWE-266) to capture authorization tokens belonging to other Dashboard, Pipelines API, or Notebook users.

AML.T0055

Impersonation

Attacker replays the stolen token to authenticate as the victim across Kubeflow UI and APIs, bypassing normal authentication.

AML.T0091.000

Impact

Attacker accesses or exfiltrates the victim's notebooks, training pipelines, and ML artifacts, or escalates further if the victim holds admin privileges.

Initial Access

Attacker obtains or already holds a low-privilege Kubeflow account that receives a kubeflow-edit/Contributor namespace via Automatic Profile Creation.

AML.T0012

Token Theft

Attacker exploits the incorrect privilege assignment (CWE-266) to capture authorization tokens belonging to other Dashboard, Pipelines API, or Notebook users.

AML.T0055

Impersonation

Attacker replays the stolen token to authenticate as the victim across Kubeflow UI and APIs, bypassing normal authentication.

AML.T0091.000

Impact

Attacker accesses or exfiltrates the victim's notebooks, training pipelines, and ML artifacts, or escalates further if the victim holds admin privileges.

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade the Kubeflow Community Distribution manifests to version 26.03-rc.1 or later, which contains the fix (see the linked GitHub Advisory GHSA-v824-8gxh-pgjw and commit 31b2411). As an interim workaround, disable Automatic Profile Creation so new/low-trust users cannot self-provision a kubeflow-edit namespace, and review existing namespace role bindings to strip kubeflow-edit/Contributor from accounts that don't need it. Rotate any tokens/sessions for high-value users (admins, users with access to production pipelines or sensitive datasets) after patching. For detection, monitor Dashboard/Pipelines API/Notebook access logs for a token being used from an unexpected namespace context or source, and alert on any authorization token appearing in requests originating outside its issuing user's normal namespace.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Framework API AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - Security of AI system infrastructure

Frequently Asked Questions

What is CVE-2026-47237?

A design flaw in the official Kubeflow Community Distribution manifests allows any authenticated user with the standard kubeflow-edit/Contributor role in their own namespace to steal the authorization tokens of other users of the Dashboard, Pipelines API, or Notebooks, effectively taking over their account and any data or models they can access. This is a low bar to clear: with Automatic Profile Creation enabled — a common, often default configuration on multi-tenant Kubeflow platforms — any new signup automatically gets an edit-capable namespace and thus the prerequisite for this attack, meaning the effective attacker population is every onboarded user, not just admins. There is no CISA KEV listing, no public PoC, and no EPSS score published yet, so this is not being mass-exploited today, but the CVSS 8.0 (network, low complexity, low privileges) reflects that exploitation requires no special tooling once an attacker has any account on the platform. Patch to Kubeflow Community Distribution 26.03-rc.1 or later, and until then disable Automatic Profile Creation and audit which users currently hold kubeflow-edit/Contributor roles, since each one is a viable launch point. Detection teams should review Dashboard, Pipelines API, and Notebook session/token issuance logs for cross-user token reuse or anomalous namespace-to-namespace access.

Is CVE-2026-47237 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47237, increasing the risk of exploitation.

How to fix CVE-2026-47237?

Upgrade the Kubeflow Community Distribution manifests to version 26.03-rc.1 or later, which contains the fix (see the linked GitHub Advisory GHSA-v824-8gxh-pgjw and commit 31b2411). As an interim workaround, disable Automatic Profile Creation so new/low-trust users cannot self-provision a kubeflow-edit namespace, and review existing namespace role bindings to strip kubeflow-edit/Contributor from accounts that don't need it. Rotate any tokens/sessions for high-value users (admins, users with access to production pipelines or sensitive datasets) after patching. For detection, monitor Dashboard/Pipelines API/Notebook access logs for a token being used from an unexpected namespace context or source, and alert on any authorization token appearing in requests originating outside its issuing user's normal namespace.

What systems are affected by CVE-2026-47237?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, MLOps orchestration platforms, notebook environments.

What is the CVSS score for CVE-2026-47237?

CVE-2026-47237 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

training pipelinesMLOps orchestration platformsnotebook environments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

What are the technical details?

Original Advisory

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the ``kubeflow-edit`` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue.

Exploitation Scenario

An attacker signs up for a self-service account on a victim organization's shared Kubeflow platform (or already has a low-privilege account), which — thanks to Automatic Profile Creation — grants them a personal namespace with the kubeflow-edit/Contributor role. The attacker abuses this baseline privilege to intercept or capture authorization tokens intended for other users as those users interact with the Dashboard, Pipelines API, or Notebooks. Using a stolen token belonging to a data scientist or admin, the attacker impersonates that user, browsing their notebooks and pipeline runs, exfiltrating proprietary training data or model artifacts, or injecting malicious steps into an active training pipeline. If the compromised token belongs to a platform admin, the attacker escalates to cluster-wide control over the Kubeflow deployment.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment Primary CWE-266 Incorrect Privilege Assignment

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.