# CVE-2026-47237: Kubeflow Community Distribution authorization token theft via Istio permissions

Source: https://junglewise.ai/threats/cve-2026-47237-kubeflow-community-distribution-authorization-token-theft-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-47237 · Severity: high · CVSS 8 · Published 2026-07-21

Kubeflow Community Distribution is a platform used to deploy and manage machine learning workflows on Kubernetes clusters. A security flaw in its default configuration allows an attacker with basic user access to steal the authentication tokens of other users, including administrators. By intercepting these tokens, an attacker can take over accounts, access sensitive research data, and manipulate machine learning pipelines or notebooks.

Vendors: [Kubeflow](https://junglewise.ai/threats/vendors/kubeflow).

## Quick answers

**Is CVE-2026-47237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47237 being exploited in the wild.

**How severe is CVE-2026-47237?** High severity, with a CVSS score of 8, published 21 July 2026.

**Which products and versions are affected?** Kubeflow Community-Distribution < 26.03-rc.1; Kubeflow Manifests <= 1.9.1.

**Is there a fix for CVE-2026-47237?** A patch was published on 2025-03-08: Fix merged via PR #3043 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47237 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47237?** Check whether you run Kubeflow Community-Distribution or Kubeflow Manifests at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from incorrect privilege assignment (CWE-266) where the 'default-editor' service account in Kubeflow namespaces is granted broad permissions on the 'networking.istio.io' API group. This allows an attacker with 'kubeflow-edit' or 'Contributor' roles to create Istio VirtualServices that override existing paths on the Kubeflow gateway (e.g., hijacking the favicon or dashboard resources). By redirecting these requests to an attacker-controlled pod, the attacker can log session cookies. To bypass default AuthorizationPolicies, the attacker can use wildcards to add victim domains to their own namespace's contributor list. The issue is fixed in version 26.03-rc.1 and via pull request #3043.

## Affected products

- kubeflow community-distribution < 26.03-rc.1
- kubeflow manifests <= 1.9.1

## Timeline

- 2025-03-08: patched: Fix merged via PR #3043
- 2026-05-19: advisory: GHSA published
- 2026-07-21: disclosed: CVE published to NVD

## References

- [https://github.com/kubeflow/community-distribution/commit/31b2411dda319bfeae8686ecdf3a39436ec32ce2](https://github.com/kubeflow/community-distribution/commit/31b2411dda319bfeae8686ecdf3a39436ec32ce2)
- [https://github.com/kubeflow/community-distribution/pull/3043](https://github.com/kubeflow/community-distribution/pull/3043)
- [https://github.com/kubeflow/community-distribution/security/advisories/GHSA-v824-8gxh-pgjw](https://github.com/kubeflow/community-distribution/security/advisories/GHSA-v824-8gxh-pgjw)