← fix library

HIGH Kubeflow: Kubeflow dashboard reachable without authentication

Why it matters

An open Kubeflow central dashboard exposes pipelines, notebooks, and cluster ML workflows to anyone who can reach the URL.

Fix it — 3 steps

  1. Enable the Kubeflow / Istio auth gateway (OIDC or similar) before publishing any dashboard route.
  2. Keep dashboards on a private network or VPN; do not publish NodePorts to the internet.
  3. Confirm anonymous GETs to the dashboard return 401/302-to-login, not the app shell.

Verify it’s fixed

curl -m 5 -I http://YOUR_SERVER_IP:8080/  # should not return the Kubeflow Central Dashboard HTML

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack