Kubeflow Pipelines: unauthenticated path traversal reads arbitrary files via volume artifacts (CVE-2026-118758), fixed in 2.18.0

Kubeflow Pipelines before 2.18.0 does not confine the file path passed to the volume artifact handler (GET /artifacts/get?source=volume) to the selected volume. A caller who can reach the route and names an existing mounted volume can use path traversal to read any file the artifact-serving process can read. The ml-pipeline-ui frontend pod serves the request when artifact proxying is disabled, and the namespace's artifact-service pod serves it when proxying is enabled. Deployments with authentication disabled need no credentials; in multi-user deployments the caller ordinarily must be authorized for the namespace. The CNA scores it CVSS 3.1 7.5 (unauthenticated, network, high confidentiality impact). Fixed in 2.18.0. The same day Kubeflow published three companion CVEs: CVE-2026-118759 (CVSS 7.5, the run log streaming endpoint skips namespace authorization and exposes pod execution logs across tenants, fixed in 2.18.0), CVE-2026-118760 (CVSS 6.5, missing namespace authorization allows cross-tenant artifact reads, fixed in 2.17.0) and CVE-2026-118761 (CVSS 7.5, a pipeline archive upload decompression bomb can exhaust server memory, fixed in 2.18.0).

Why this severity: CVSS 3.1 7.5 from the CNA (AV:N/AC:L/PR:N/UI:N, confidentiality high). It is a file read, not code execution, and multi-user deployments normally require namespace authorization. No in-the-wild exploitation has been reported.

Started

Oct 29, 2026

CVEs

CVE-2026-118758CVE-2026-118759CVE-2026-118760CVE-2026-118761

• #Kubeflow
• Kubernetes
• AI / LLM tooling
• #Path Traversal