CVE-2026-118759 kubeflow CVE debrief

Who should care

Defenders responsible for Kubeflow Pipelines deployments should assess exposure and prioritize upgrading to a fixed version. This includes operators, platform administrators, and security teams who manage Kubeflow Pipelines environments. They should review the vulnerability's impact on their systems, implement compensating controls if necessary, and monitor for suspicious activity.

Why it matters

Defenders should care about CVE-2026-118759 because it allows unauthorized access to pod logs in Kubeflow Pipelines, potentially exposing sensitive workload data or credentials.

• Read access to sensitive workload data or credentials in logs
• Potential for lateral movement or unauthorized access to related systems
• Need for verification of API server pod-log permissions and run ID enumeration
• Priority for upgrading to Kubeflow Pipelines 2.18.0 or later

Technical summary

The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler is vulnerable to unauthorized access, allowing a caller to read live or archived logs using the API server's permissions. This issue arises from the handler's lack of authorization checks, enabling access to logs without proper validation. The vulnerability impacts Kubeflow Pipelines versions through 2.17.3, and upgrading to version 2.18.0 or later mitigates the issue. Defenders should prioritize upgrading and restrict access to the API server.

Defensive priority

Defenders should prioritize upgrading to Kubeflow Pipelines 2.18.0 or later and restrict access to the API server.

Recommended defensive actions

• Upgrade to Kubeflow Pipelines 2.18.0 or later
• Restrict access to the API server
• Monitor API server logs for suspicious activity
• Verify API server pod-log permissions and run ID enumeration
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The source corpus provides details on the vulnerable handler and the potential impact of unauthorized log access. The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler is vulnerable to unauthorized access, allowing a caller to read live or archived logs using the API server's permissions. Evidence is based on the source item and official CVE record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.