{"id":"CVE-2026-118758","kind":"vulnerability","aliases":["CVE-2026-118758"],"related":[],"title":"Kubeflow Pipelines: artifact route path traversal reads files outside volumes","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.","summary":"Kubeflow Pipelines before 2.18.0 does not confine file paths requested through the GET /artifacts/get volume handler. An attacker who can reach that route and name an existing mounted volume can read files outside that volume, as far as the artifact-serving process can read them.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubeflow","kubernetes","machine-learning","package","self-hosted"],"not_affected_if":["auth-required","namespace-authorization-enforced","version-2.18.0-or-later"],"how_to_check":"- Check the installed Kubeflow Pipelines version; affected if it is below `2.18.0`.\n- Check whether artifact proxying is enabled in the deployment; the frontend pod or the namespace's artifact-service pod serves the route depending on that setting.\n- Check whether authentication is disabled or the route is reachable from untrusted callers.","fix":"- Kubeflow Pipelines: move to `2.18.0` or later.","status":"open","published_at":"2026-10-29T17:18:06+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","triaged_at":"2026-10-29T17:27:52+00:00","updated_at":"2026-10-29T17:27:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T17:27:52Z","model":"claude-haiku-5-5","output":{"fix":"- Kubeflow Pipelines: move to `2.18.0` or later.","reach":"network","title":"Kubeflow Pipelines: artifact route path traversal reads files outside volumes","impact":"medium","summary":"Kubeflow Pipelines before 2.18.0 does not confine file paths requested through the GET /artifacts/get volume handler. An attacker who can reach that route and name an existing mounted volume can read files outside that volume, as far as the artifact-serving process can read them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kubeflow","kubernetes","machine-learning","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads arbitrary files the artifact service can access.","analyst_note":"","how_to_check":"- Check the installed Kubeflow Pipelines version; affected if it is below `2.18.0`.\n- Check whether artifact proxying is enabled in the deployment; the frontend pod or the namespace's artifact-service pod serves the route depending on that setting.\n- Check whether authentication is disabled or the route is reachable from untrusted callers.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.18.0-or-later","auth-required","namespace-authorization-enforced"],"who_is_affected":"Deployments running Kubeflow Pipelines before 2.18.0 are exposed if the GET /artifacts/get route is reachable by a caller and the artifact-serving process can read files outside the mounted volume. With authentication disabled no credentials are needed; in multi-user deployments the caller must be authorized for the supplied namespace. Teams using a managed service or a version at or above 2.18.0 can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4270,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118758':13A,16A '-2026':12A,15A '/artifacts/get':39B,93C '2.18.0':29B,86C,197C 'applic':174C 'artifact':3A,66B,89C,135C,148C,158C 'artifact-serv':65B,134C 'artifact-servic':157C 'attack':43B 'authent':170C 'author':186C 'build':76C 'caller':101C,110C,182C 'caller-suppli':100C 'confin':32B,98C 'credenti':175C 'cve':11A,14A 'deploy':78C,168C,180C 'disabl':151C,171C 'enabl':73C,166C 'exist':52B,119C 'far':62B 'file':8A,33B,57B,103C,128C 'fix':194C 'frontend':142C 'get':38B,92C 'handler':41B,90C 'host':25B 'identifi':117C 'issu':192C 'kubeflow':1A,17B,26B,71C 'kubernet':18B 'learn':21B,82C 'machin':20B,81C 'machine-learn':19B 'mount':53B,120C 'multi':178C 'multi-us':177C 'must':184C 'name':50B 'namespac':155C,190C 'ordinarili':183C 'outsid':9A,58B,129C 'packag':22B 'path':5A,34B,104C,124C 'pipelin':2A,27B,72C 'pod':143C,160C 'portabl':79C 'prior':84C 'process':68B,137C 'proxi':149C,164C 'reach':46B,113C 'read':7A,56B,70B,127C,139C 'request':35B,146C 'requir':172C 'rout':4A,48B,115C 'scalabl':80C 'select':107C,154C 'self':24B 'self-host':23B 'serv':67B,136C,144C,161C 'servic':159C 'sourc':94C 'suppli':102C,189C 'travers':6A,125C 'use':123C 'user':74C,179C 'version':196C 'volum':10A,40B,54B,60B,88C,95C,108C,121C,131C 'workflow':83C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Kubeflow Pipelines before 2.18.0 are exposed if the GET /artifacts/get route is reachable by a caller and the artifact-serving process can read files outside the mounted volume. With authentication disabled no credentials are needed; in multi-user deployments the caller must be authorized for the supplied namespace. Teams using a managed service or a version at or above 2.18.0 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T17:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118758","severity":null,"published_at":"2026-10-29T17:18:06+00:00","modified_at":"2026-10-29T17:18:06+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}