CVE-2026-54745

In Kubeflow Pipelines prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. This is fixed in version 2.18.0.

In Kubeflow Pipelines from 0.5.1 until 2.17.0, frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user knowing an artifact location could select another tenant's namespace or omit the namespace to read artifact contents such as datasets, models, or pipeline outputs.

In Kubeflow Pipelines prior to 2.18.0, the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller knowing a run ID and pod or node identifier could read logs with the API server's permissions, and for live logs the node ID was accepted as a pod name without verifying pod membership in the run.

In Kubeflow Pipelines prior to 2.18.0, the volume artifact handler GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller knowing an existing mounted volume could use path traversal to read files outside it when the artifact-serving process could read them.