ETK-2026-2938Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2938",
  "cve_id": null,
  "display_id": "ETK-2026-2938",
  "ghsa_id": "GHSA-wg5q-x4j9-qm54",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Missing authorization for log access in kfp-api-server",
  "summary": "The Kubeflow Pipelines kfp-api-server log endpoint can return run logs without verifying that the caller is authorized for the selected run. An unauthenticated attacker who can reach the backend and knows suitable run and node or pod identifiers may read sensitive workload logs, including logs from another pod in the run namespace for live-log requests.",
  "mitigation": "Upgrade ghcr.io/kubeflow/kfp-api-server to version 2.18.0. Until then, restrict access to the backend log endpoint with an external authentication gate or network policy.",
  "vendor": "other",
  "product": "other:ghcr.io/kubeflow/kfp-api-server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.17.3"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "2.18.0"
      ],
      "package_name": "ghcr.io/kubeflow/kfp-api-server",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.752115866666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T04:44:21+00:00",
      "days": -0.11851976858796297,
      "is_lower_bound": true,
      "measured_at": "2026-10-29T07:35:01.154834+00:00",
      "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54"
    }
  }
}