CVE-2026-118760: Kubeflow Pipelines artifact routes allow cross-namespace artifact reads

Summary

Kubeflow Pipelines versions from 0.5.1 through 2.17.0 have frontend artifact routes that do not verify whether an authenticated user may access the requested namespace. A user who can reach the frontend and knows an artifact location can read another tenant's datasets, models, or pipeline outputs by selecting that namespace or omitting it to reach an unguarded direct handler. The flaw affects multi-user deployments relying on Kubeflow Pipelines for tenant isolation, and the source states it does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution.

Mitigation

Fixed in version 2.17.0.

Related items

• MediumCVE-2026-104314: IBM Langflow OSS exposes stored credentials to flow readers via APISimilar attack · NVD/CVE Database
• InfoA Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication EfficiencySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSimilar attack · AWS Security Bulletins
• MediumOpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning ProtectionsSimilar attack · The Hacker News
• MediumOpenAI’s August fix for theft of reasoning traces was quickly bypassedSimilar attack · CSO Online