HIGH

CVE-2026-18618

2026-08-10 CVSS v3.1

CVSS

7.5

Description

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.54%

Probability of exploitation in next 30 days

44.1th percentile

References

https://access.redhat.com/errata/RHSA-2026:53261 https://access.redhat.com/errata/RHSA-2026:53262 https://access.redhat.com/errata/RHSA-2026:53263 https://access.redhat.com/errata/RHSA-2026:60367 https://access.redhat.com/security/cve/CVE-2026-18618 https://bugzilla.redhat.com/show_bug.cgi?id=2510313

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE