GoPackage

github.com/kubeflow/pipelines

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release: v1.7.0-alpha.3 (Jul 12, 2021): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 3 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-118761High 7.5
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Affected: fixed in 0.0.0-20260831164314-ba9ae72cc860; versions 1.7.0-alpha.3.
No fix released. The advisory names 0.0.0-20260831164314-ba9ae72cc860 as the fix, which the registry doesn't have yet. The latest release, v1.7.0-alpha.3, is still affected.
CVE-2026-118759High 7.5
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Affected: fixed in 0.0.0-20260904182349-be4723e33727; versions 1.7.0-alpha.3.
No fix released. The advisory names 0.0.0-20260904182349-be4723e33727 as the fix, which the registry doesn't have yet. The latest release, v1.7.0-alpha.3, is still affected.
CVE-2024-9526High 7.1
Stored XSS in Kubeflow Pipeline View
Affected: all versions.
No fix released. The latest release, v1.7.0-alpha.3, is still affected.