← fix library

FIX CARD
PRODUCT Kubeflow
SEVERITY HIGH

HIGH

Kubeflow dashboard reachable without authentication

Why it matters

An open Kubeflow central dashboard exposes pipelines, notebooks, and cluster ML workflows to anyone who can reach the URL.

Fix it: 3 steps

  1. Enable the Kubeflow / Istio auth gateway (OIDC or similar) before publishing any dashboard route.
  2. Keep dashboards on a private network or VPN; do not publish NodePorts to the internet.
  3. Confirm anonymous GETs to the dashboard return 401/302-to-login, not the app shell.

Verify it’s fixed

curl -m 5 -I http://YOUR_SERVER_IP:8080/  # should not return the Kubeflow Central Dashboard HTML

References

Not sure if your stack is exposed?

Run the free check: usually under a minute, safe read-only probes.

Scan your stack