Caching Misconfiguration in Kubeflow Pipelines Affects Multi-User Deployments

CVE-2026-88982

What is CVE-2026-88982?

In earlier versions of Kubeflow Pipelines, a vulnerability exists in the legacy V1/raw-Argo execution cache. The mutating webhook and cache-server storage path permit the selection of template fields without sufficient isolation, relying solely on the key for lookups and duplicate checks. This flaw can allow a tenant with submission privileges within a shared cache service to access another tenant's cached outputs or even inject malicious outputs in workflows. Updating to version 2.18.0 addresses this significant issue by enhancing the cache's security model, ensuring tenants can no longer interact with or compromise each other's cached resources.

References