Authorization Vulnerability in Kubeflow Pipelines by Kubeflow

CVE-2026-88984

What is CVE-2026-88984?

Kubeflow Pipelines, utilized for building and deploying scalable machine learning workflows, has an authorization vulnerability affecting versions prior to 2.16.1. This flaw allows authenticated users to modify or delete shared pipeline definitions and their versions in an empty namespace, circumventing the necessary Kubernetes RBAC permissions. As a result, the integrity and availability of these shared resources could be compromised. Though read-only access is intentionally maintained for shared pipelines, risks arise from the potential modification and execution of pipelines, which could lead to unintended downstream effects. This vulnerability is remedied in version 2.16.1; however, note that the multipart upload authorization for shared pipelines is not addressed within this version.

References