Kubeflow Pipelines CVE-2026-118758

Exploitation requires the attacker to (1) be able to reach the GET /artifacts/get?source=volume route and (2) identify an existing mounted volume to anchor the traversal; the targeted file must be readable by the artifact-serving process - the frontend pod when artifact proxying is disabled, or the selected namespace's artifact-service pod when proxying is enabled. In a deployment with authentication disabled, no application credentials are required (matching PR:N). The principal limiting factor is multi-user mode: there the caller ordinarily must already be authorized for the supplied namespace, and the traversal does not bypass that authorization check, so an unauthorized outsider cannot reach it. Impact is further limited to disclosure of files the serving process can already read, and escape is confined to files outside the selected volume - access to sensitive files already inside a selectable volume depends on the deployment's volume policy, not this flaw.

This is a genuine but bounded priority. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes the worst-case reachable deployment with authentication disabled, where no credentials are needed and the flaw is network-reachable at low complexity - a realistic concern for standalone/single-user installs. However, the GHSA advisory explicitly states that in multi-user deployments the caller ordinarily must be authorized for the supplied namespace, corresponding to a lower 6.5 score with PR:L; the traversal does not bypass that authorization check, so hardened multi-user clusters face materially lower risk than the headline 7.5 suggests. Impact is confidentiality-only (C:H/I:N/A:N): the attacker reads files the serving process can read, which may include configuration or mounted credentials, but the advisory is careful to note this does not by itself establish cluster compromise, file modification, or availability loss. No EPSS score and no KEV status are provided in the input, and no CISA listing is present, so there is no signal of active or widespread exploitation; the vendor priority label is this_week, consistent with prompt-remediation rather than emergency. Overall this warrants timely patching, especially for auth-disabled deployments, but it is not an automatable full-compromise bug.

An attacker who can reach the GET /artifacts/get?source=volume route on a Kubeflow Pipelines deployment with authentication disabled supplies a crafted file path containing traversal sequences referencing an existing mounted volume. Because the handler did not confine the path to the selected volume, the artifact-serving process (the frontend pod when proxying is disabled, or the namespace artifact-service pod when enabled) streams back files outside that volume, potentially exposing configuration files or mounted credentials. No verified working exploit code is identified in the input; the original report exercised the production handler functions against a mocked pod specification rather than a deployed cluster.