Description
Kubeflow是Google推出的开源机器学习工具包，旨在让Kubernetes上的机器学习工作流变得简单、可移植和可扩展。Kubeflow Central Dashboard是Kubeflow的核心管理界面，用于管理和监控机器学习工作流、实验和模型训练任务。Kubeflow Dashboard /api/workgroup/env-info 接口存在未授权访问漏洞，攻击者无需认证即可访问该接口获取系统环境信息和配置数据。
Kubeflow Dashboard /api/workgroup/env-info 未授权访问漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/kubeflow/kubeflow/issues/4788
https://www.aliyun.com/notice/116427
https://cloud.tencent.com/announce/detail/1142
https://www.huaweicloud.com/notice/2018/20200614233532548.html
https://insinuator.net/2026/05/cve-2026-47237-overly-permissive-istio-permissions-allow-kubeflow-authorization-token-stealing/