Path Traversal Vulnerability in Kubeflow Pipelines by Kubeflow

CVE-2026-118758

What is CVE-2026-118758?

The path traversal vulnerability in Kubeflow Pipelines allows an unauthenticated caller to read files stored outside the intended volume. This occurs when a user accesses the artifact route without proper confinement of the file path, potentially exposing sensitive information. The issue arises particularly in deployments where authentication is disabled and can be exploited in multi-user environments, emphasizing the need for stringent access controls. This vulnerability has been addressed in version 2.18.0, which ensures more secure handling of file paths during artifact retrieval.

References