CVE-2026-118759

{
  "etk_id": "ETK-2026-2938",
  "cve_id": "CVE-2026-118759",
  "display_id": "CVE-2026-118759",
  "ghsa_id": "GHSA-wg5q-x4j9-qm54",
  "euvd_id": "EUVD-2026-113216",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization in Kubeflow Pipelines API server log access",
  "summary": "Kubeflow Pipelines API server versions through 2.17.3 can return run logs without verifying that the caller is authorized for the selected run. An attacker able to reach the backend and identify a target run and suitable node or pod can read live or archived logs, potentially including logs from another pod in the run namespace. External authentication or network controls can limit exposure.",
  "mitigation": "Upgrade ghcr.io/kubeflow/kfp-api-server to version 2.18.0. Until then, restrict access to the backend log endpoint with an authentication gateway or network policy.",
  "vendor": "other",
  "product": "other:ghcr.io/kubeflow/kfp-api-server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.17.3"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "2.18.0"
      ],
      "package_name": "ghcr.io/kubeflow/kfp-api-server",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.557877816666668,
  "t0_at": "2026-10-29T16:30:25.711000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T04:44:21+00:00",
      "days": -0.49033230324074073,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T16:30:25.711000+00:00",
      "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54"
    }
  }
}