Kubeflow Pipelines prior to version 2.18.0 exposed a path traversal flaw in the volume artifact request handler. An attacker who can reach the GET /artifacts/get?source=volume endpoint can supply a crafted file path that is not confined to the intended volume, causing the artifact service to read and return the contents of any file visible to the process. This flaw (CWE‑22) lets an unauthenticated or minimally privileged user read arbitrary files on the hosting node or pod, potentially exposing sensitive configuration or credential data.

The vulnerability affects the Kubeflow Pipelines product across all releases preceding 2.18.0. Deployments running an older version, especially those with authentication disabled or default ingress settings that expose the artifact endpoint to external traffic, are susceptible.

The CVSS score of 7.5 indicates a high risk when authentication and authorization are bypassed. Because the exploit requires only a simple HTTP request to the exposed endpoint, and authentication can be absent in some deployments, the attack surface is broad. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet; however, attackers with network access to the cluster can trigger the path traversal and retrieve arbitrary files, making this a significant threat in multi‑user or poorly secured environments.