github.com/kubeflow/pipelines

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high7.5

CVE-2026-118761Fix available

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Go / github.com/kubeflow/pipelines

1 day ago

github.com/kubeflow/pipelines Go

Affected range	Recorded fix
Earlier releases before 0.0.0-20260831164314-ba9ae72cc860Semantic versions	0.0.0-20260831164314-ba9ae72cc860

Version evidence: OSV · GHSA-8fmv-6rg5-5924

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "0.0.0-20260831164314-ba9ae72cc860"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

github.com/kubeflow/pipelines Go

Read the explicit versions or original source for affected-version evidence.

Version evidence: OSV · GHSA-8fmv-6rg5-5924

View original version evidence

{
  "ranges": [],
  "versions": [
    "1.7.0-alpha.3"
  ]
}

high7.5

CVE-2026-118759Fix available

Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant

Go / github.com/kubeflow/pipelines

1 day ago

github.com/kubeflow/pipelines Go

Affected range	Recorded fix
Earlier releases before 0.0.0-20260904182349-be4723e33727Semantic versions	0.0.0-20260904182349-be4723e33727

Version evidence: OSV · GHSA-wg5q-x4j9-qm54

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "0.0.0-20260904182349-be4723e33727"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

github.com/kubeflow/pipelines Go

Read the explicit versions or original source for affected-version evidence.

Version evidence: OSV · GHSA-wg5q-x4j9-qm54

View original version evidence

{
  "ranges": [],
  "versions": [
    "1.7.0-alpha.3"
  ]
}