CVE-2026-118761: Pre-Authorization Decompression Bomb Denial of Service in Kubeflow Pipelines API Server

Vulnerability ID: CVE-2026-118761
CVSS Score: 7.5
Published: 2026-10-30

A high-severity Denial of Service (DoS) vulnerability exists in Kubeflow Pipelines prior to version 2.18.0 due to improper handling of highly compressed archive files (CWE-409). The API server decompresses uploaded ZIP and gzip-compressed TAR archives directly into memory without bounding the expanded byte stream or archive traversal metadata. Because decompression occurs before namespace-level authorization in multipart upload handlers, an unauthenticated or unauthorized attacker with network access to the API server can exhaust container heap memory and trigger Out-Of-Memory (OOM) terminations.

TL;DR

Kubeflow Pipelines prior to 2.18.0 fails to bound uncompressed output streams and TAR PAX metadata during pipeline archive uploads. Because multipart upload handlers process archives prior to authorization checks, remote callers can submit small compression bombs to trigger an Out-Of-Memory (OOM) crash in the API server.

⚠️ Exploit Status: POC

Technical Details

  • CVE / Advisory ID: CVE-2026-118761 / GHSA-8fmv-6rg5-5924
  • Weakness Class: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
  • CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  • Attack Vector: Network (Pre-authorization multipart HTTP archive upload)
  • EPSS Score: 0.50% (42.47th Percentile)
  • Primary Impact: Denial of Service via Container Out-Of-Memory (OOM) Termination
  • Affected Versions: Kubeflow Pipelines < 2.18.0
  • Patched Version: Kubeflow Pipelines 2.18.0

Affected Systems

  • Kubeflow Pipelines API Server (ml-pipeline-apiserver)
  • Kubeflow Pipelines Persistence Agent (ml-pipeline-persistenceagent)
  • Kubeflow Pipelines: < 2.18.0 (Fixed in: 2.18.0)

Code Analysis

Commit: 1121d9a

Enforce uncompressed file size limits using io.LimitReader in loadFile, decompressPipelineTarball, and decompressPipelineZip (PR #14171).

Commit: ba9ae72

Prevent tarball traversal DoS via ArchiveTraversalBudget, +1 sentinel checks before io.EOF, saturating arithmetic helpers, and persistence agent response bounds (PR #14186).

Exploit Details

Mitigation Strategies

  • Upgrade Kubeflow Pipelines to version 2.18.0 or later to enforce bounded decompression and TAR traversal budgets.
  • Implement service mesh (Istio AuthorizationPolicy) or API gateway authentication rules to block unauthenticated access to pipeline upload endpoints.
  • Apply Kubernetes NetworkPolicies to restrict direct pod-to-pod and external network access to the ml-pipeline-apiserver service.
  • Configure strict HTTP request body size limits on the Ingress controller or reverse proxy fronting the Kubeflow API server.
  • Define explicit memory limits (resources.limits.memory) on the ml-pipeline-apiserver and persistenceagent deployments to isolate OOM events from the host node.

Remediation Steps:

  1. Verify the currently deployed Kubeflow Pipelines version by inspecting the container image tags on the ml-pipeline and ml-pipeline-persistenceagent deployments.
  2. Update the Kubeflow Pipelines manifests or Helm charts to reference release version 2.18.0 (https://github.com/kubeflow/pipelines/releases/tag/2.18.0).
  3. Apply the updated manifests to the cluster and verify that the ml-pipeline-apiserver and ml-pipeline-persistenceagent pods roll out cleanly.
  4. Audit Istio AuthorizationPolicies or Ingress configurations to ensure that /apis/v1beta1/pipelines/upload and /apis/v2beta1/pipelines/upload cannot be reached by unauthenticated clients.
  5. Monitor cluster events for OOMKilled terminations using: kubectl get events -n kubeflow --field-selector reason=OOMKilled

References

Read the full report for CVE-2026-118761 on our website for more details including interactive diagrams and full exploit analysis.