# Kubeflow Pipelines: unauthenticated path traversal reads arbitrary files via volume artifacts (CVE-2026-118758), fixed in 2.18.0 · pwn.watch > Kubeflow Pipelines before 2.18.0 does not confine the file path passed to the volume artifact handler (GET /artifacts/get?source=volume) to the selected volume. A caller who can reach the route and names an existing mounted volume can use path traversal to read any file the artifact-serving process can read. The ml-pipeline-ui frontend pod serves the request when artifact proxying is disabled, and the namespace's artifact-service pod serves it when proxying is enabled. Deployments with authentication disabled need no credentials; in multi-user deployments the caller ordinarily must be authorized for the namespace. The CNA scores it CVSS 3.1 7.5 (unauthenticated, network, high confidentiality impact). Fixed in 2.18.0. The same day Kubeflow published three companion CVEs: CVE-2026-118759 (CVSS 7.5, the run log streaming endpoint skips namespace authorization and exposes pod execution logs across tenants, fixed in 2.18.0), CVE-2026-118760 (CVSS 6.5, missing namespace authorization allows cross-tenant artifact reads, fixed in 2.17.0) and CVE-2026-118761 (CVSS 7.5, a pipeline archive upload decompression bomb can exhaust server memory, fixed in 2.18.0). Page: https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758 · generated 2026-10-29T20:46:10.933Z ## Status - Severity: high · status: live · patch: patched - Product: Kubeflow Pipelines - Started: 2026-10-29 - CVEs: CVE-2026-118758, CVE-2026-118759, CVE-2026-118760, CVE-2026-118761 - Affected: Kubeflow Pipelines before 2.18.0 (CVE-2026-118758, CVE-2026-118759, CVE-2026-118761); Kubeflow Pipelines before 2.17.0 (CVE-2026-118760) - Fixed in: 2.18.0 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758/feed.xml - JSON Feed: https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758.json - This file: https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758/llms.txt ## Updates (newest first) - 2026-10-29: Kubeflow publishes GHSA-2fg9-fx2f-439r and CVE-2026-118758 for a volume artifact path traversal in ml-pipeline-ui, fixed in 2.18.0. (https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r) - 2026-10-29: Kubeflow publishes three more Pipelines CVEs: cross-tenant run log exposure (CVE-2026-118759, 7.5), cross-tenant artifact reads (CVE-2026-118760, 6.5, fixed in 2.17.0) and an archive upload decompression bomb (CVE-2026-118761, 7.5). (https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54) ## Fix brief # Security brief: Kubeflow Pipelines: unauthenticated path traversal reads arbitrary files via volume artifacts (CVE-2026-118758), fixed in 2.18.0 Source: https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758 · status: live · severity: high · updated Oct 29, 2026, 16:56 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Kubeflow Pipelines before 2.18.0 does not confine the file path passed to the volume artifact handler (GET /artifacts/get?source=volume) to the selected volume. A caller who can reach the route and names an existing mounted volume can use path traversal to read any file the artifact-serving process can read. The ml-pipeline-ui frontend pod serves the request when artifact proxying is disabled, and the namespace's artifact-service pod serves it when proxying is enabled. Deployments with authentication disabled need no credentials; in multi-user deployments the caller ordinarily must be authorized for the namespace. The CNA scores it CVSS 3.1 7.5 (unauthenticated, network, high confidentiality impact). Fixed in 2.18.0. The same day Kubeflow published three companion CVEs: CVE-2026-118759 (CVSS 7.5, the run log streaming endpoint skips namespace authorization and exposes pod execution logs across tenants, fixed in 2.18.0), CVE-2026-118760 (CVSS 6.5, missing namespace authorization allows cross-tenant artifact reads, fixed in 2.17.0) and CVE-2026-118761 (CVSS 7.5, a pipeline archive upload decompression bomb can exhaust server memory, fixed in 2.18.0). Severity detail: CVSS 3.1 7.5 from the CNA (AV:N/AC:L/PR:N/UI:N, confidentiality high). It is a file read, not code execution, and multi-user deployments normally require namespace authorization. No in-the-wild exploitation has been reported. - Product: Kubeflow Pipelines - CVE / advisory ids: CVE-2026-118758, CVE-2026-118759, CVE-2026-118760, CVE-2026-118761 ## Affected versions - Kubeflow Pipelines before 2.18.0 (CVE-2026-118758, CVE-2026-118759, CVE-2026-118761) - Kubeflow Pipelines before 2.17.0 (CVE-2026-118760) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 2.18.0 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you run Kubeflow Pipelines, upgrade to 2.18.0 (read the 2.18 upgrade guide for custom storage settings). Until then, keep the ml-pipeline-ui and artifact-service endpoints off the public internet and make sure authentication is enabled. If an instance was exposed without auth, assume files readable by those pods (including mounted secrets and service account tokens) may have been read and rotate them. ## Latest updates - Oct 29, 2026: Kubeflow publishes GHSA-2fg9-fx2f-439r and CVE-2026-118758 for a volume artifact path traversal in ml-pipeline-ui, fixed in 2.18.0. - Oct 29, 2026: Kubeflow publishes three more Pipelines CVEs: cross-tenant run log exposure (CVE-2026-118759, 7.5), cross-tenant artifact reads (CVE-2026-118760, 6.5, fixed in 2.17.0) and an archive upload decompression bomb (CVE-2026-118761, 7.5). ## Advisories - [GHSA-2fg9-fx2f-439r: Volume artifact path traversal permits disclosure of process-readable files](https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r) (Kubeflow) - [CVE-2026-118758: Kubeflow unauthenticated path traversal to arbitrary file read on ml-pipeline-ui](https://www.cve.org/CVERecord?id=CVE-2026-118758) (CVE.org) - [GHSA-wg5q-x4j9-qm54 (CVE-2026-118759): Run log streaming endpoint bypasses namespace authorization](https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54) (Kubeflow) - [GHSA-vjhf-6c8f-qhwj (CVE-2026-118760): Missing namespace authorization permits cross-tenant artifact reads](https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj) (Kubeflow) - [GHSA-8fmv-6rg5-5924 (CVE-2026-118761): Pipeline archive upload decompression bomb exhausts server memory](https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924) (Kubeflow) - [Kubeflow Pipelines 2.18.0 release](https://github.com/kubeflow/pipelines/releases/tag/2.18.0) (Kubeflow) --- Machine-readable: https://pwn.watch/i/kubeflow-pipelines-volume-artifact-path-traversal-cve-2026-118758.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.