The vulnerability arises from the Kubeflow Pipelines API server decompressing pipeline archive uploads without size or expansion limits. When a maliciously crafted ZIP or gzip archive is uploaded, the server attempts to decompress the entire archive before verifying namespace authorization or pipeline existence. This can lead to a very large memory footprint, potentially exhausting API‑server resources and causing it to become unresponsive. The flaw is a classic resource‑exhaustion flaw and is identified as CWE‑409.

The flaw affects Kubernetes deployments running Kubeflow Pipelines prior to version 2.18.0. The impacted component is the API server responsible for pipeline and pipeline‑version uploads, including multipart and URL‑import handlers. Any cluster using an older Pipelines release is vulnerable until the component is updated.

The CVSS score of 7.5 reflects a high risk, combined with the lack of required authentication for upload before decompression. An attacker who can reach the API endpoint, whether they have valid credentials or not, can trigger the archive decompression. The absence of EPSS data does not remove the concern; a decompression bomb is a well‑known attack technique that can lead to denial of service if the application fails to enforce size limits. Since the vulnerability is in the core upload logic and does not depend on additional configuration, it is likely exploitable in many deployments.