CVE-2026-118761 in Pipelines
Summary
by MITRE • 10/29/2026
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
Kubeflow Pipelines serves as a critical infrastructure component for orchestrating machine learning workflows, allowing data scientists and engineers to build, deploy, and manage portable ML pipelines at scale. The system relies on an API server to handle various operations including the ingestion of pipeline definitions packaged in compressed archives such as ZIP or gzip-compressed tar files. In versions prior to 2.18.0, a significant architectural flaw existed within this ingestion process that exposed the underlying infrastructure to resource exhaustion attacks. This vulnerability stems from how the API server handles file decompression during the upload workflow, specifically lacking adequate bounds on the expansion of compressed data relative to its original size.
The core technical flaw involves an insufficiently bounded zip bomb scenario where a malicious actor can craft a small archive that expands into a disproportionately large amount of uncompressed data upon extraction. When users upload pipeline archives through the API server, the system attempts to locate and read the pipeline file by decompressing the uploaded content. However, prior to the fix, this decomposition process did not enforce strict limits on memory consumption or disk space usage during expansion. Consequently, a relatively small input file could trigger massive resource allocation within the application container, leading to severe performance degradation or complete service unavailability due to out-of-memory conditions.
A critical aspect of this vulnerability is its impact on authorization logic and access control boundaries. The multipart pipeline upload mechanism performs decompression before executing namespace-level authorization checks. This ordering error means that a reachable caller does not need a successful pipeline-create authorization decision to trigger the resource exhaustion condition. Essentially, any user or service account with network reachability to the API server endpoint can initiate this process without requiring valid permissions for creating pipelines in specific namespaces. In contrast, URL-import handlers correctly authorize requests before fetching and decompressing remote archives, highlighting an inconsistency in security controls across different input vectors within the same application module.
The operational impact of this vulnerability is primarily denial-of-service against the Kubeflow Pipelines API server. The severity of the service interruption depends heavily on the deployment configuration, specifically resource limits such as CPU and memory constraints assigned to the pod or container running the API server. Additionally, concurrent activity levels within the cluster influence how quickly resources are exhausted; high concurrency can accelerate the degradation process even with smaller malicious payloads. It is important to note that no single archive is guaranteed to crash every deployment due to varying resource limits and environmental factors, but the potential for service disruption remains a persistent risk for any exposed instance running affected versions.
This vulnerability aligns with CWE-787: Out-of-bounds Read in terms of memory access patterns during decompression if it leads to crashes, but more accurately maps to CWE-400: Uncontrolled Resource Consumption and CWE-1321: Improperly Controlled Compression Ratio (Zip Bomb). From an offensive security perspective, this flaw can be leveraged via the MITRE ATT&CK technique T1496: Resource Hijacking or specifically as a Denial of Service attack vector where attackers aim to disrupt availability rather than compromise confidentiality or integrity. The lack of pre-authentication resource validation represents a significant deviation from secure coding practices recommended for web-facing APIs handling untrusted input.
To mitigate this vulnerability, organizations must upgrade Kubeflow Pipelines to version 2.18.0 or later, where the decompression logic has been corrected to enforce strict bounds on expanded data sizes. Until an upgrade is feasible, administrators should implement network-level controls such as Web Application Firewalls (WAF) with rate limiting and payload size restrictions to prevent excessively large uploads from reaching the API server. Additionally, enforcing stricter namespace authorization checks prior to any file processing operations can help reduce the attack surface by ensuring that only authorized users can initiate resource-intensive operations like archive decompression. Regular auditing of upload endpoints for similar patterns where authentication is deferred until after expensive computational tasks will further harden the infrastructure against future instances of this class of vulnerability.