Kubeflow (centraldashboard-angular backend, email validation regex): A catastrophically backtracking regex in the

Impact

A catastrophically backtracking regex in the dashboard's email validation lets an unauthenticated caller pin the backend's CPU with one crafted string. Repeat it and the Kubeflow entry point becomes unusable, so no tenant can reach notebooks, pipelines or the GPU workloads behind them.

Who can reach it

Any unauthenticated client that can reach the centraldashboard-angular backend. Single request, no session.

What to do

Upgrade the Kubeflow central dashboard to a release with the corrected validation and redeploy. Put a rate limit and request-size cap in front of the dashboard, and set CPU limits on the pod so one abusive request cannot starve the node.

References