Package vulnerability, severity high

github.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Published October 30, 2026, updated October 31, 2026

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs. Source: GHSA-wg5q-x4j9-qm54 (CVE-2026-118759).

What's affected

• github.com/kubeflow/pipelines (go)<0.0.0-20260904182349-be4723e33727
• github.com/kubeflow/pipelines (go)1.7.0-alpha.3

What to do

1. Upgrade github.com/kubeflow/pipelines to 0.0.0-20260904182349-be4723e33727 or later.
2. No fixed version of github.com/kubeflow/pipelines yet: see the advisory for workarounds.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-wg5q-x4j9-qm54

References

• https://osv.dev/vulnerability/GHSA-wg5q-x4j9-qm54
• https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54
• https://nvd.nist.gov/vuln/detail/CVE-2026-118759
• https://github.com/kubeflow/pipelines/pull/13684
• https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f
• https://github.com/kubeflow/pipelines
• https://github.com/kubeflow/pipelines/releases/tag/2.18.0

Notice ghsa-wg5q-x4j9-qm54, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.