AIKIDO-2026-917323

TL;DR

The core Model Registry REST server performs no authentication or authorization of its own and never reads the caller identity, so tenant isolation depends entirely on the shipped Istio authorization policy. That policy admits any in-mesh caller that presents a non-empty Authorization header and omits the kubeflow-userid header, with no check on the caller principal or source namespace, and no request authentication validates the token. A pod in any namespace can reach another tenant's Model Registry to read, modify, and remove registered models, versions, and artifacts, including rewriting an artifact URI to swap the served model. The fix constrains the mesh policy to authorized caller identities and namespaces so the server is no longer reachable cross-tenant.