Is CVE-2026-118759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118759 being exploited in the wild.

How severe is CVE-2026-118759?

High severity, with a CVSS score of 7.5, published 29 October 2026.

Which products and versions are affected?

github.com/kubeflow/pipelines (Go) < 0.0.0-20260904182349-be4723e33727, SEMVER:introduced=0,fixed=0.0.0-20260904182349-be4723e33727; Kubeflow Pipelines before 2.18.0.

Is there a fix for CVE-2026-118759?

Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260904182349-be4723e33727 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118759 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-118759?

Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118759: Kubeflow Pipelines authorization bypass in log retrieval API

Q: Is there a fix for CVE-2026-118759?

Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260904182349-be4723e33727 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118759 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-118759?

Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118759 · Severity: high · CVSS 7.5 · Published 2026-10-29

Kubeflow Pipelines is a machine learning workflow platform that manages containerized job execution. Prior to version 2.18.0, the log retrieval API endpoint failed to authorize access to workflow logs, allowing any authenticated user to read logs from any workflow they should not have access to, potentially exposing sensitive credentials or data contained in those logs.

Technologies: github.com/kubeflow/pipelines (Go), Kubeflow Pipelines. Vendors: Go, Kubeflow.

Quick answers

Is CVE-2026-118759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118759 being exploited in the wild.
How severe is CVE-2026-118759?: High severity, with a CVSS score of 7.5, published 29 October 2026.
Which products and versions are affected?: github.com/kubeflow/pipelines (Go) < 0.0.0-20260904182349-be4723e33727, SEMVER:introduced=0,fixed=0.0.0-20260904182349-be4723e33727; Kubeflow Pipelines before 2.18.0.
Is there a fix for CVE-2026-118759?: Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260904182349-be4723e33727 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118759 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-118759?: Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260904182349-be4723e33727 or later
```
go get github.com/kubeflow/pipelines@v0.0.0-20260904182349-be4723e33727
```

Technical details

The GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler in the Kubeflow Pipelines API server did not perform authorization checks before streaming pod logs, and accepted arbitrary node IDs as pod names without verifying the pod belonged to the requested run. An attacker with network access and knowledge of a run ID could read live or archived logs using the API server's permissions, including logs from pods in unrelated namespaces by exploiting the pod name validation bypass.

Affected products

Kubeflow Pipelines before 2.18.0

Identifiers

CVE-2026-118759
GHSA-wg5q-x4j9-qm54
GO-2026-6900

Timeline

2026-10-29: disclosed
2026-09-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.