https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-118761/https://vulnfeed.org/cve/CVE-2026-118761/Fri, 30 Oct 2026 23:13:38 +0000## Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service. Multipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment. ## Remediation Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established. [PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits. Until upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversa…https://vulnfeed.org/cve/CVE-2026-118759/https://vulnfeed.org/cve/CVE-2026-118759/Fri, 30 Oct 2026 23:13:29 +0000## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived logs using the API server's permissions. For live logs, the vulnerable handler also accepts the supplied node ID as a pod name in the run's namespace without verifying that the pod belongs to the run. Depending on the API server's pod-log permissions, a known run ID can therefore permit reading the `main` container logs of an unrelated pod in that namespace. Logs may contain sensitive workload data or credentials. The affected handler does not authenticate the request itself. An external authentication gate or network policy can restrict reachability; public ingress exposure and unauthenticated enumeration of run IDs are not assumed. ## Remediation Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established. [PR #13684](https://github.com/kubeflow/pipelines/pull/13684) authorizes the caller with the `readLog` verb before retrieving live or archived logs. For live logs, it also verifies that the pod's `pipeline/runid` label matches the requested run. Custom Kubernetes roles must grant `readLog` on `runs` in the `pipelines.kubeflow.org` API group; the bundled viewer and editor roles include it. Shared read access alone does not grant log access. Until upgrading, restrict access to the backend log endpoint. Focused regression tests cover authorization denial, HTTP identity propagation, pod/run mismatch, archive retrieval, and cancellation; no new deployed-cluster end-to-end test was performed for this assessment. ## Credit [bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Nayyar ([@naruto-lgtm](https:/…