Decompression bomb in Kubeflow Pipelines exhausts API server memory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Kubeflow Pipelines before 2.18.0 has a flaw (CWE-409) in how the API server handles highly compressed pipeline uploads. The API server decompresses uploaded archives without bounding the expanded data, so a small ZIP or gzip-compressed tar archive can consume large amounts of memory. A remote attacker without credentials can exhaust API server resources and interrupt service, because multipart upload decompresses archives before namespace authorization is checked.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kubeflow | pipelines | before 2.18.0 | 2.18.0 | Patch available | CNA |
| — | github.com/kubeflow/pipelines (Go) | before 0.0.0-20260831164314-ba9ae72cc860 | 0.0.0-20260831164314-ba9ae72cc860 | Patch available | GHSA-8fmv-6rg5-5924 |
| — | github.com/kubeflow/pipelines (Go) | — | — | No fix listed | GHSA-8fmv-6rg5-5924 |
- pipelines Vendorkubeflow Affected before 2.18.0 Fixed in 2.18.0 Patch available CNA
- github.com/kubeflow/pipelines (Go) Vendor— Affected before 0.0.0-20260831164314-ba9ae72cc860 Fixed in 0.0.0-20260831164314-ba9ae72cc860 Patch available GHSA-8fmv-6rg5-5924
- github.com/kubeflow/pipelines (Go) Vendor— Affected — Fixed in — No fix listed GHSA-8fmv-6rg5-5924
Remediation
Upgrade Kubeflow Pipelines to version 2.18.0 or later. Upgrade github.com/kubeflow/pipelines to pseudo-version 0.0.0-20260831164314-ba9ae72cc860 or later. Red Hat rates this Important; for Red Hat OpenShift AI (RHOAI), the sources list no fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA pipelines (kubeflow) Fixed in 2.18.0
- Fix · GHSA-8fmv-6rg5-5924 github.com/kubeflow/pipelines (Go) Fixed in 0.0.0-20260831164314-ba9ae72cc860 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118761
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → LOW
- 2026-10-30 Alias added: GHSA-8fmv-6rg5-5924
- 2026-10-30 Fix available: Go/github.com/kubeflow/[email protected] · GHSA-8fmv-6rg5-5924
- 2026-10-30 CVSS score added · GHSA-8fmv-6rg5-5924
- 2026-10-30 Weakness changed · GHSA-8fmv-6rg5-5924
- 2026-10-30 8 new references · GHSA-8fmv-6rg5-5924
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
References
Other 7
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924
- https://github.com/kubeflow/pipelines/pull/14171
- https://github.com/kubeflow/pipelines/pull/14186
- https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953
- https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
- https://github.com/kubeflow/pipelines
More kubeflow vulnerabilities
- TI-2026-39556 Improper access control in kubeflow pipelines CVSS 3.1CRITICAL 10.0
- TI-2024-05160 ReDoS in kubeflow/kubeflow CVSS 3.1HIGH 7.5
- TI-2026-34822 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing CVSS 3.1HIGH 8.0
- TI-2026-85696 Server-side request forgery in Kubeflow Pipelines TensorBoard proxy CVSS 3.1MEDIUM 5.8
- TI-2026-73437 Server-side request forgery in Kubeflow Model Registry leaks tokens CVSS 4.0HIGH 7.1
- TI-2026-85698 Server-side request forgery in Kubeflow Pipelines artifact endpoints CVSS 3.1HIGH 8.6
Sources
- CVE-2026-118761 · CVE Program
- CVE-2026-118761 · NVD
- FIRST EPSS
- GHSA-8fmv-6rg5-5924 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118761 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences