Path traversal in Kubeflow Pipelines allows reading arbitrary files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Kubeflow Pipelines before 2.18.0 has a path traversal flaw (CWE-22) in the volume artifact handler for GET /artifacts/get?source=volume. The handler does not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can read files outside that volume when the artifact-serving process can read them. No credentials are needed when authentication is disabled, while multi-user deployments require the caller to be authorized for the supplied namespace.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Kubeflow Pipelines to version 2.18.0, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA pipelines (kubeflow) Fixed in 2.18.0
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118758
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → LOW
References
Other 5
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r
- https://github.com/kubeflow/pipelines/pull/13677
- https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f
- https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
More kubeflow vulnerabilities
- TI-2026-39556 Improper access control in kubeflow pipelines CVSS 3.1CRITICAL 10.0
- TI-2024-05160 ReDoS in kubeflow/kubeflow CVSS 3.1HIGH 7.5
- TI-2026-34822 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing CVSS 3.1HIGH 8.0
- TI-2026-85696 Server-side request forgery in Kubeflow Pipelines TensorBoard proxy CVSS 3.1MEDIUM 5.8
- TI-2026-73437 Server-side request forgery in Kubeflow Model Registry leaks tokens CVSS 4.0HIGH 7.1
- TI-2026-85698 Server-side request forgery in Kubeflow Pipelines artifact endpoints CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences