CVE-2026-118758: Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kubeflow Pipelinesto a version that resolves this vulnerability.Fixed in 2.18.0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Deployments with authentication disabled require no application credentials. An attacker must be able to reach the artifact route and identify an existing mounted volume.
What authorization is required in a multi-user deployment?
The caller ordinarily must be authorized for the namespace supplied in the request. No additional application credentials are required when authentication is disabled.
What files could be exposed?
A caller can attempt to read files outside the selected volume using path traversal. Exposure is limited to files that the process serving the artifact request can read.
Does artifact proxying change the impact?
Artifact proxying changes which pod serves the request, not the underlying path-confinement issue. With proxying disabled, the frontend pod serves it; with proxying enabled, the selected namespace's artifact-service pod serves it.
What version contains the fix?
The issue is fixed in version 2.18.0.