pipelines vulnerabilities
CVEs whose affected-version data names the pipelines package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-118758High· 7.5Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the sele…
▾ Twilightkubeflow · pipelinesEPSS 0.53%via CVEORG
CVE-2026-118760Medium· 6.5Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested …
▾ Sunlitkubeflow · pipelinesEPSS 0.35%via CVEORG