CVE-2026-118758Published
Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Exact source revision recorded 29 Oct 2026 18:12:12 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118758 · Microsoft / collected KEV context
cve-program · CVE-2026-118758
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r
- https://github.com/kubeflow/pipelines/pull/13677
- https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f
- https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.