Detections
Analytics

SCA: security update for github.com/kubeflow/pipelines (GHSA-8fmv-6rg5-5924)

high Tenable Self-Hosted Container Security Plugin ID 478079

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior
 to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded
 data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume
 disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version
 upload processing performs decompression before namespace authorization, so a reachable caller does not
 need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching
 and decompressing a remote archive. The amount of expansion required to interrupt service depends on
 deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every
 deployment. This issue is fixed in version 2.18.0. (CVE-2026-118761)

Solution

Update the github.com/kubeflow/pipelines library and its related packages to version 0.0.0-20260831164314-ba9ae72cc860 or later.

See Also

https://github.com/advisories/GHSA-8fmv-6rg5-5924

Plugin Details

Severity: High

ID: 478079

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-118761

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/30/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-118761

cwe: CWE-409