A compressed pipeline upload can trigger expensive decompression while the service searches for the pipeline definition. The cost is charged to the shared API server even when the caller should not gain access to a protected namespace. The demonstrated problem is an availability boundary in an AI/ML workflow service, not privilege escalation or access to…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow decompressed uploaded pipeline archives before bounding resource cost
The Kubeflow Pipelines advisory reports that a compact attacker-supplied pipeline archive could expand during extraction and exhaust API server memory before later request checks completed.
Scope
Resource exhaustion is conditional on upload reachability and concurrent workload size; no field outage or access-control bypass is established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The advisory isolates processing-cost exhaustion through a user-supplied pipeline archive before fully applying bounded resource controls. It does not prove cross-tenant log access or arbitrary system code execution. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-KUBEFLOW-ARCHIVE-RESOURCE-1 · Kubeflow Pipelines GHSA-8fmv-6rg5-5924 upload decompression advisory
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsResource exhaustion is conditional on upload reachability and concurrent workload size; no field outage or access-control bypass is established.
Limits and uncertaintyFull account
A compressed pipeline upload can trigger expensive decompression while the service searches for the pipeline definition. The cost is charged to the shared API server even when the caller should not gain access to a protected namespace. The demonstrated problem is an availability boundary in an AI/ML workflow service, not privilege escalation or access to another tenant’s logs.
Mechanism and trust boundary
- 01
An upload handler expands untrusted ZIP or tar data without a strict decompressed-byte budget before further authorization and validation.
Claims & evidence
CLM-2026-NOV01-KUBEFLOW-ARCHIVE-RESOURCE-1The Kubeflow Pipelines advisory reports that a compact attacker-supplied pipeline archive could expand during extraction and exhaust API server memory before later request checks completed.supported
Basis: reported finding
- supportsKubeflow Pipelines GHSA-8fmv-6rg5-5924 upload decompression advisoryprimary disclosure
GHSA-8fmv-6rg5-5924, Summary, impact and fixed pseudo-version
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Bound compressed and decompressed byte counts before parsing, enforce upload request limits and check authorization as early as possible.
Unknowns and contradictions
- Resource exhaustion is conditional on upload reachability and concurrent workload size; no field outage or access-control bypass is established.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 211