Authorization Bypass in Kubeflow Pipelines API for Log Retrieval

CVE-2026-118759

What is CVE-2026-118759?

Kubeflow Pipelines allows users to build and deploy machine learning workflows. A vulnerability existed in the API server's log retrieval process prior to version 2.18.0, where it failed to properly authorize access to logs based on the run ID. An attacker with access to the backend could exploit this by using a known run ID and a valid pod or node identifier to access live or archived logs, potentially uncovering sensitive data or credentials. Logs from unrelated pods could also be retrieved, further exposing critical information. This issue has been addressed in release 2.18.0.

References