Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118758— Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source

Quick assessment

Affected
kubeflow pipelines
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kubeflow Pipelines 允许用户构建和部署可移植、可扩展的机器学习工作流。在 2.18.0 版本之前，用于处理 请求的卷（volume）工件处理器，未将调用者提供的文件路径限制在所选卷内。若调用者能够访问该路由并识别出已挂载的卷，则可通过路径遍历攻击读取该卷之外的文件（前提是工件服务进程拥有读取这些文件的权限）。当禁用工件代理（artifact proxying）时，前端 Pod 会处理该请求；当启用代理时，则由目标命名空间中的 artifact-service Pod 处理。在禁用认证功能的部署环境

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118758

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Source: CVE Program / CVE List V5
Vulnerability Description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kubeflow pipelines < 2.18.0 -

II. Public POCs for CVE-2026-118758

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118758

请登录查看更多情报信息。

Other References for CVE-2026-118758 (5)

Same Patch Batch · kubeflow · 2026-10-29 · 4 CVEs total

CVE-2026-118759 7.5 HIGH Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing
CVE-2026-118761 7.5 HIGH Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server me
CVE-2026-118760 6.5 MEDIUM Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads

IV. Related Vulnerabilities

Same product: pipelines
Same vendor: kubeflow
Same weakness: CWE-22