Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118761— Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Quick assessment

Affected
kubeflow pipelines
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kubeflow Pipelines 允许用户构建和部署可移植、可扩展的机器学习工作流。在 2.18.0 版本之前，API 服务器在定位或读取流水线文件时，对上传的流水线归档进行解压缩，但未对解压后的数据大小进行充分限制。因此，一个小型的 ZIP 或 gzip 压缩的 tar 归档即可消耗不成比例的大量内存，导致 API 服务器资源耗尽。 在 multipart 流水线及流水线版本上传处理过程中，解压缩操作发生在命名空间授权之前，因此，可被触发的调用方无需获得“创建流水线”的授权即可发起攻击。而通过 URL 导入的

CVSS 7.5 · High EPSS 0.50% · P42

Affected Version Matrix 1

VendorProduct Version RangeStatus
kubeflow pipelines < 2.18.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118761

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Source: CVE Program / CVE List V5
Vulnerability Description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kubeflow pipelines < 2.18.0 -

II. Public POCs for CVE-2026-118761

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118761

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118761 (2)

Vendor Advisories for CVE-2026-118761 (1)

Vendor Pages for CVE-2026-118761 (1)

Same Patch Batch · kubeflow · 2026-10-29 · 4 CVEs total

CVE-2026-118758 7.5 HIGH Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the
CVE-2026-118759 7.5 HIGH Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing
CVE-2026-118760 6.5 MEDIUM Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads

IV. Related Vulnerabilities

Same product: pipelines
Same vendor: kubeflow
Same weakness: CWE-409