CVE-2026-118761
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In Kubeflow Pipelines prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. This is fixed in version 2.18.0.
Risk Assessment
An attacker could exhaust memory and resources of the Kubeflow Pipelines API server, causing denial of service for platform users. The required expansion depends on deployment resource limits and concurrent activity.
Recommendation
Upgrade Kubeflow Pipelines to version 2.18.0 and consider limiting uploaded archive sizes and API server resource limits.
Other vulnerabilities in Kubeflow Pipelines
See all- CVE-2026-54745Critical
Kubeflow Pipelines before version 2.17.0 has an unauthenticated SSRF vulnerability in the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route is accessible without authorization, allowing requests to be forwarded to internal services and responses returned to the attacker. This issue is fixed in version 2.17.0.
- CVE-2026-118760Medium
In Kubeflow Pipelines from 0.5.1 until 2.17.0, frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user knowing an artifact location could select another tenant's namespace or omit the namespace to read artifact contents such as datasets, models, or pipeline outputs.
- CVE-2026-118759High
In Kubeflow Pipelines prior to 2.18.0, the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller knowing a run ID and pod or node identifier could read logs with the API server's permissions, and for live logs the node ID was accepted as a pod name without verifying pod membership in the run.
- CVE-2026-118758High
In Kubeflow Pipelines prior to 2.18.0, the volume artifact handler GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller knowing an existing mounted volume could use path traversal to read files outside it when the artifact-serving process could read them.
Original NVD description (English source)
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS