CVE-2026-18618
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A flaw was found in ml-metadata where the statically-linked gRPC stack is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker with network access to the MLMD pod could exploit this by sending specially crafted HTTP/2 requests, potentially crashing the pod and disrupting pipeline runs.
Risk Assessment
The risk is a denial of service in the MLMD environment, which could halt all running pipelines and impact service availability.
Recommendation
Update ml-metadata to a version with a patched gRPC stack and restrict network access to the MLMD pod.
Original NVD description (English source)
A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.