Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

Fix availableCritical · CVSS 9.6EPSS 0.25%

Published Nov 9, 2026 · updated Nov 9, 2026

What to do

  1. Upgrade to a fixed version: github.com/kubeflow/pipelines 0.0.0-20260909234119-62516d8c525f.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/kubeflow/pipelines

Vulnerable versions
< 0.0.0-20260909234119-62516d8c525f
Fixed in
0.0.0-20260909234119-62516d8c525f

Check your project: go list -m all | grep github.com/kubeflow/pipelines

What changed

  1. Nov 9, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-639 Authorization Bypass Through User-Controlled Key · CWE-862 Missing Authorization

← All critical vulnerabilities