Kubeflow Pipelines API server contains an authorization bypass vulnerability in the run-log endpoint, allowing unauthorized users who can access the backend and know a run ID to read logs of that run or unrelated pods in the same namespace. This can expose sensitive workload data or credentials. The issue affects versions through 2.17.3 and is fixed in version 2.18.0.