Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source

pipelines · Path traversal · CWE-22

Affectedpipelines

FixNo fix listed yet.

PublishedOct 29, 16:12 · GitHub_M

ScoredOct 29 · 7.5 · GitHub_M

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

A successful attack can read data. CVSS impact.

Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed inpipelines< 2.18.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r · github.comrefsource_CONFIRM github.com/kubeflow/pipelines/pull/13677 · github.comrefsource_MISC github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f · github.comrefsource_MISC github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout · github.comrefsource_MISC github.com/kubeflow/pipelines/releases/tag/2.18.0 · github.comrefsource_MISC

Other CVEs in pipelines

All 4 →

7.5Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory · CVE-2026-118761Oct 29 6.5Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads · CVE-2026-118760Oct 29 7.5Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant · CVE-2026-118759Oct 29