Kubeflow Pipelines EUVD-2026-113219

Exploitation requires network reachability to the API server's multipart pipeline-upload or pipeline-version-upload endpoints, which decompress the archive before namespace authorization - so a reachable caller does not need a successful pipeline-create authorization decision. The attack uses a crafted small ZIP or gzip-compressed tar archive whose expansion is disproportionate to its compressed size. What LIMITS exploitation: the URL-import handlers are NOT vulnerable to the pre-auth path because they authorize before fetching and decompressing; external authentication and network controls in front of the API server can restrict who reaches the upload endpoints; and success is not guaranteed by any single archive because the expansion needed depends on the deployment's resource limits and concurrent activity. Affected versions are Kubeflow Pipelines through 2.17.3; the issue is fixed in 2.18.0.

This is a credible but bounded availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a network-reachable, low-complexity attack affecting availability only, with no confidentiality or integrity impact. The vuln.today decision label is 'this_week', consistent with a serious DoS that is not under active exploitation. No EPSS score was supplied, no KEV listing is present, and no SSVC fields were provided, so exploitation-probability and automatability signals are missing from the input and cannot be weighed. The key amplifier is that multipart pipeline and pipeline-version upload processing decompresses the archive BEFORE namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision - this is what justifies PR:N. The main mitigating realities, stated by the vendor, are that external authentication and network controls can restrict reachability, that URL-import handlers authorize before fetching/decompressing, and that no particular archive is guaranteed to crash every deployment because the expansion needed depends on deployment resource limits and concurrent activity. Net: treat as a real priority for internet- or multi-tenant-exposed Kubeflow Pipelines API servers, but a lower-urgency patch where the upload endpoints already sit behind strong authentication and network segmentation.

An attacker who can reach the Kubeflow Pipelines API server's multipart pipeline or pipeline-version upload endpoint submits a small ZIP or gzip-compressed tar 'decompression bomb'. Because decompression happens before namespace authorization, the server expands the archive into memory while locating or reading the pipeline file, consuming disproportionate memory and potentially exhausting API-server resources and interrupting service. No public exploit identified at time of analysis; the referenced links are the vendor advisory, fix PRs, and commits, not a working exploit.