Threats affecting pkg:github/kubeflow/pipelines

Kubeflow Pipelines prior to version 2.18.0 contains a vulnerability where the API server decompresses uploaded pipeline archives without properly limiting the expanded data size. This can lead to excessive memory consumption and resource exhaustion, potentially causing a denial of service. The vulnerability arises because decompression occurs before namespace authorization during multipart uploads, allowing unauthenticated callers to trigger resource exhaustion. The issue is fixed in version 2.18.0.

Kubeflow Pipelines versions prior to 2.17.0 contain an authorization bypass vulnerability in the frontend artifact routes. Authenticated users could access artifact contents from other tenants' namespaces without proper authorization checks, potentially exposing datasets, models, or pipeline outputs. This affects multi-user deployments relying on Kubeflow Pipelines for tenant isolation. The vulnerability does not allow disclosure of Kubernetes Secrets, modification of storage, or server-side code execution. The issue is fixed in version 2.17.0.

A vulnerability in Kubeflow Pipelines prior to version 2.18.0 allows unauthorized access to logs via the API server's log retrieval endpoint. The API server does not authorize callers against the selected run, enabling an attacker with network access and knowledge of run and node IDs to read live or archived logs. This includes the ability to read logs from unrelated pods by manipulating node IDs. The exposed logs may contain sensitive workload data or credentials. The issue is fixed in version 2.18.0.

CVE-2026-118758 is a path traversal vulnerability in Kubeflow Pipelines prior to version 2.18.0. The volume artifact handler for the GET /artifacts/get?source=volume endpoint did not properly restrict file paths to the selected volume, allowing an attacker who can access this route and identify a mounted volume to read files outside that volume. The vulnerability affects deployments with disabled authentication or where the attacker is authorized for the namespace. The issue is fixed in version 2.18.0.