CVE-2026-18618

The CVE affects ml-metadata where the statically-linked gRPC stack is outdated, exposing HTTP/2 DoS vulnerabilities. An in-cluster attacker with network access to the MLMD pod could send specially crafted HTTP/2 requests to crash the MLMD pod, disrupting all pipeline runs in the affected namespac...