HighVulnerability
CVE-2026-118759: Kubeflow Pipelines run log endpoint exposes logs without authorization
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-118759
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
CVE-2026-118759 affects Kubeflow Pipelines before 2.18.0. The GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler returns logs without checking that the caller is authorized for the selected run, so a caller who can reach the backend and knows a run ID and a pod or node identifier can read live or archived logs with the API server's permissions. Live log requests also accept the node ID as a pod name without verifying run ownership, letting a known run ID reach an unrelated pod's main container logs.
Mitigation
Fixed in 2.18.0.