CVE-2026-118761: CVE-2026-118761: Pre-Authorization Decompression Bomb Denial of Service in Kubeflow Pipelines API Server

Kubeflow Pipelines versions before 2.18.0 contain two high-severity vulnerabilities. CVE-2026-118759 involves an authorization bypass in the run log streaming endpoint, allowing cross-tenant pod log exposure because the API server fails to verify pod ownership. Additionally, CVE-2026-118761 enables a pre-authorization decompression bomb Denial of Service. This occurs because the API server decompresses ZIP and gzip-compressed TAR archives into memory without bounds before performing namespace-level authorization, allowing unauthenticated attackers to crash the system.