# CVE-2026-118759: Kubeflow Pipelines authorization bypass in log retrieval API

Source: https://junglewise.ai/threats/cve-2026-118759-kubeflow-pipelines-enables-users-to-build-and-deploy-portable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118759 · Severity: high · CVSS 7.5 · Published 2026-10-29

Kubeflow Pipelines is a machine learning workflow platform that manages containerized job execution. Prior to version 2.18.0, the log retrieval API endpoint failed to authorize access to workflow logs, allowing any authenticated user to read logs from any workflow they should not have access to, potentially exposing sensitive credentials or data contained in those logs.

Technologies: [github.com/kubeflow/pipelines (Go)](https://junglewise.ai/threats/technologies/github-com-kubeflow-pipelines), [Kubeflow Pipelines](https://junglewise.ai/threats/technologies/kubeflow-pipelines). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Kubeflow](https://junglewise.ai/threats/vendors/kubeflow).

## Quick answers

**Is CVE-2026-118759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118759 being exploited in the wild.

**How severe is CVE-2026-118759?** High severity, with a CVSS score of 7.5, published 29 October 2026.

**Which products and versions are affected?** github.com/kubeflow/pipelines (Go) < 0.0.0-20260904182349-be4723e33727, SEMVER:introduced=0,fixed=0.0.0-20260904182349-be4723e33727; Kubeflow Pipelines before 2.18.0.

**Is there a fix for CVE-2026-118759?** Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260904182349-be4723e33727 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118759 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-118759?** Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260904182349-be4723e33727 or later

  ```sh
  go get github.com/kubeflow/pipelines@v0.0.0-20260904182349-be4723e33727
  ```


## Technical details

The GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler in the Kubeflow Pipelines API server did not perform authorization checks before streaming pod logs, and accepted arbitrary node IDs as pod names without verifying the pod belonged to the requested run. An attacker with network access and knowledge of a run ID could read live or archived logs using the API server's permissions, including logs from pods in unrelated namespaces by exploiting the pod name validation bypass.

## Affected products

- Kubeflow Pipelines before 2.18.0

## Identifiers

- CVE-2026-118759
- GHSA-wg5q-x4j9-qm54
- GO-2026-6900

## Timeline

- 2026-10-29: disclosed
- 2026-09-04: patched

## References

- [https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f](https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f)
- [https://github.com/kubeflow/pipelines/pull/13684](https://github.com/kubeflow/pipelines/pull/13684)

## Related threats

- [Kubeflow Pipelines authorization bypass in shared pipelines](https://junglewise.ai/threats/cve-2026-88984-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines cross-tenant cache isolation in execution cache](https://junglewise.ai/threats/cve-2026-88982-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines arbitrary endpoint connection in artifact download](https://junglewise.ai/threats/cve-2026-88981-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines authorization bypass in pipeline upload](https://junglewise.ai/threats/cve-2026-77596-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)
- [Kubeflow Pipelines reflected XSS in pod query endpoints](https://junglewise.ai/threats/cve-2026-88986-kubeflow-pipelines-enables-users-to-build-and-deploy-portable)