# CVE-2026-118758: Kubeflow Pipelines path traversal in artifact handler

Source: https://junglewise.ai/threats/cve-2026-118758-kubeflow-pipelines-enables-users-to-build-and-deploy-portable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118758 · Severity: high · CVSS 7.5 · Published 2026-10-29

Kubeflow Pipelines is an open-source system for building and managing machine learning workflows. A path-traversal vulnerability in the artifact-serving component allows an attacker with access to the GET /artifacts/get API endpoint to read files outside the intended volume by supplying specially crafted file paths, potentially exposing sensitive data stored on the system.

Technologies: [Kubeflow Pipelines](https://junglewise.ai/threats/technologies/kubeflow-pipelines). Vendors: [Kubeflow](https://junglewise.ai/threats/vendors/kubeflow).

## Quick answers

**Is CVE-2026-118758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118758 being exploited in the wild.

**How severe is CVE-2026-118758?** High severity, with a CVSS score of 7.5, published 29 October 2026.

**Which products and versions are affected?** Kubeflow Pipelines prior to 2.18.0.

**Is there a fix for CVE-2026-118758?** Yes: fixed in 2.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118758 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-118758?** Check whether you run Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.18.0

## Technical details

The volume artifact handler for GET /artifacts/get?source=volume prior to 2.18.0 does not properly validate and confine caller-supplied file paths to the selected volume, enabling path traversal attacks. The vulnerability affects both the frontend pod (when artifact proxying is disabled) and the artifact-service pod in the selected namespace (when proxying is enabled). Exploitation requires network access to the route and knowledge of an existing mounted volume; deployments with authentication disabled need no credentials, while multi-user deployments require namespace authorization.

## Affected products

- Kubeflow Pipelines prior to 2.18.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md](https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md)
- [https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f](https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f)

## Related threats

- [Kubeflow Pipelines authorization bypass in shared pipelines](https://junglewise.ai/threats/cve-2026-88984-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines cross-tenant cache isolation in execution cache](https://junglewise.ai/threats/cve-2026-88982-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines arbitrary endpoint connection in artifact download](https://junglewise.ai/threats/cve-2026-88981-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines authorization bypass in pipeline upload](https://junglewise.ai/threats/cve-2026-77596-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines reflected XSS in pod query endpoints](https://junglewise.ai/threats/cve-2026-88986-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)