VulnSocial

CVE-2026-47237Disclosure

LOWCVSS 8.0 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the ``kubeflow-edit`` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-266

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-20: 2Technical Details · 2026-05-20: 105-20
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets1 URL
Full discourse2 posts
  • Nicolas Krassas@Dinosn
    General

    CVE-2026-47237 – Overly Permissive Istio Permissions Allow Kubeflow Authorization Token Stealing https://insinuator.net/2026/05/cve-2026-47237-overly-permissive-istio-permissions-allow-kubeflow-authorization-token-stealing/

    Post summary

    The provided line highlights a CVE involving Istio permissions that could enable Kubeflow token theft, but offers no PoC, exploit details, evidence of active use, patch information, or technical depth.

    0301021.7K
    158.6K followersView on X
  • Enno Rey@Enno_Insinuator
    Disclosure

    CVE-2026-47237 – Overly Permissive Istio Permissions Allow Kubeflow Authorization Token Stealing, via @Insinuator https://insinuator.net/2026/05/cve-2026-47237-overly-permissive-istio-permissions-allow-kubeflow-authorization-token-stealing/

    Post summary

    CVE-2026-47237 highlights how overly permissive Istio permissions can enable Kubeflow authorization token theft, as detailed by @Insinuator.

    02030405
    7.4K followersView on X

Explore more

Back to dashboard