KubeFlow Audit Complete! – OSTIF.org
Skip to content
Post published:June 24, 2026
Post category:ADA Logics / Audits / CNCF / Open Source
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Kubeflow. Kubeflow functions for building and deploying customizable machine learning workflows in Kubernetes, and has many subprojects able to be implemented individually or in combination. Thanks to ADA Logics and the Cloud Native Computing Foundation, Kubeflow underwent a custom security engagement that audited 6 projects in the Kubeflow ecosystem.
Audit Process :
In late summer of 2025, two security engineers from ADA Logics performed a holistic review of a selection of projects in the Kubeflow ecosystem: Katib, Trainer, Spark Operator, Notebooks, Model Registry, and Pipelines. These audits included CI testing, fuzzing work, thread modeling, code review, and supply chain security review for each of the projects. Read more about each project’s results in the audit report linked below.
Audit Results :
14 Findings with Security Impact
3 Critical
7 Moderate
2 Low
2 Informational
OpenSSF Scorecard assessments of all 6 projects
Custom threat modelling documentation for all 6 projects
Fuzzing implemented for 4 projects: Katib, Pipeline, Spark Operator, and Model Registry
Custom documentation of the audit scope, discovery, and findings with security impact.
Kubeflow maintainers and community worked to resolve and address the issues reported during this engagement. To take advantage of the work done, update to the most recent release of Kubeflow.
As machine learning rapidly advances and changes the open source environment, engagements that holistically engage with projects in Artificial Intelligence (AI) are important to the ecosystem. They create documentation about the security implications of a project at a given time in order to help maintainers with future development as well as educate users on safe and best practices in the code they are utilizing in AI.
Thank you to the individuals and groups that made this engagement possible:
Kubeflow maintainers and community, especially: Julius Von Kojout, Matthew Wicks, Francisco Arceo, Humair Kahn, Jeff Spahr, Andy Stoneberg, and Andrey Velichkevich
ADA Logics: Adam Korczynski and David Korczynski
Cloud Native Computing Foundation
You can read the Audit Report HERE
Everyone around the world depends on open source software. If you’re interested in supporting this critical work, reach out to us!
Tags: ADA Logics, Audit, cncf, Kubeflow, OSTIF
Topics
7ASecurity
ADA Logics
Audits
AWS
Bug Bounties
Chainguard
CNCF
Community
Eclipse Foundation
Encryption
Financial
Fundraiser
Include Security
Kudelski Security
Linux Kernel
Monero
News
Open Source
OpenSSL
OpenVPN
QuarksLab
Security
Shielder
Sovereign Tech Agency
Sovereign Tech Agency
Trail of Bits
Transparency
Unbound DNS
Uncategorized
VeraCrypt
WireGuard
X41-Dsec
Archives<br>Archives
Select Month<br>June 2026<br>May 2026<br>April 2026<br>March 2026<br>February 2026<br>January 2026<br>December 2025<br>November 2025<br>October 2025<br>September 2025<br>August 2025<br>July 2025<br>June 2025<br>May 2025<br>April 2025<br>March 2025<br>February 2025<br>January 2025<br>December 2024<br>October 2024<br>September 2024<br>August 2024<br>July 2024<br>June 2024<br>May 2024<br>April 2024<br>March 2024<br>February 2024<br>January 2024<br>December 2023<br>November 2023<br>October 2023<br>September 2023<br>August 2023<br>July 2023<br>June 2023<br>May 2023<br>April 2023<br>March 2023<br>February 2023<br>January 2023<br>December 2022<br>November 2022<br>October 2022<br>August 2022<br>July 2022<br>June 2022<br>November 2021<br>October 2021<br>September 2021<br>June 2021<br>January 2021<br>July 2020<br>April 2020<br>December 2019<br>August 2019<br>July 2019<br>June 2019<br>May 2019<br>February 2019<br>January 2019<br>October 2018<br>September 2018<br>July 2018<br>May 2018<br>March 2018<br>January 2018<br>November 2017<br>October 2017<br>September 2017<br>July 2017<br>June 2017<br>May 2017<br>April 2017<br>March 2017<br>February 2017<br>January 2017<br>December 2016<br>November 2016<br>October 2016<br>September 2016<br>August 2016<br>June 2016<br>May 2016<br>April 2016<br>February 2016<br>January 2016<br>December 2015<br>November 2015<br>October 2015<br>September 2015<br>July 2015<br>May 2015
Categories
7ASecurity
ADA Logics
Audits
AWS
Bug Bounties
Chainguard
CNCF
Community
Eclipse Foundation
Encryption
Financial
Fundraiser
Include Security
Kudelski Security
Linux Kernel
Monero
News
Open Source
OpenSSL
OpenVPN
QuarksLab
Security
Shielder
Sovereign Tech Agency
Sovereign Tech Agency
Trail of Bits
Transparency
Unbound DNS
Uncategorized
VeraCrypt
WireGuard
X41-Dsec
Archives
June 2026
May 2026
April 2026
March 2026
February 2026
January 2026
December 2025
November 2025
October 2025
September 2025
August 2025
July 2025
June 2025
May 2025
April 2025
March 2025
February 2025
January 2025
December 2024
October 2024
September 2024
August 2024
July 2024
June 2024
May 2024
April 2024
March 2024
February 2024
January 2024
December 2023
November 2023
October 2023
September...