Decompression Vulnerability in Kubeflow Pipelines API Server

CVE-2026-118761

What is CVE-2026-118761?

The Kubeflow Pipelines API Server had a vulnerability where it decompressed uploaded pipeline archives without adequately limiting the resource consumption. This flaw could lead to disproportionately high memory usage, potentially exhausting the API server's resources. The decompression process occurred before namespace authorization, allowing potentially harmful uploads without prior checks. While decompression of remote archives requires authorization, the risk of service interruption is dependent on deployment limits and concurrent operations. The issue has been resolved in version 2.18.0, ensuring improved resource management and security.

References