CVE-2026-118760
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In Kubeflow Pipelines from 0.5.1 until 2.17.0, frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user knowing an artifact location could select another tenant's namespace or omit the namespace to read artifact contents such as datasets, models, or pipeline outputs.
Risk Assessment
Unauthorized disclosure of artifacts across tenants is possible in multi-user deployments relying on Kubeflow Pipelines authorization.
Recommendation
Update Kubeflow Pipelines to version 2.17.0 or later and verify namespace authorization configuration.
Other vulnerabilities in Kubeflow Pipelines
See all- CVE-2026-54745Critical
Kubeflow Pipelines before version 2.17.0 has an unauthenticated SSRF vulnerability in the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route is accessible without authorization, allowing requests to be forwarded to internal services and responses returned to the attacker. This issue is fixed in version 2.17.0.
- CVE-2026-118761High
In Kubeflow Pipelines prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. This is fixed in version 2.18.0.
- CVE-2026-118759High
In Kubeflow Pipelines prior to 2.18.0, the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller knowing a run ID and pod or node identifier could read logs with the API server's permissions, and for live logs the node ID was accepted as a pod name without verifying pod membership in the run.
- CVE-2026-118758High
In Kubeflow Pipelines prior to 2.18.0, the volume artifact handler GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller knowing an existing mounted volume could use path traversal to read files outside it when the artifact-serving process could read them.
Original NVD description (English source)
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS