{"data":{"id":"339e1b95-bf1f-41d9-a096-792c0243bf5d","title":"CVE-2026-88984: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1…","summary":"Kubeflow Pipelines versions prior to 2.16.1 let the multi-user API server skip authorization for modification and deletion of shared or global pipelines, which use an empty namespace. An authenticated user without the required Kubernetes RBAC permissions can change or delete shared pipeline definitions and versions, harming their integrity and availability. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not fixed by 2.16.1.","solution":"Fixed in version 2.16.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88984","publishedAt":"2026-11-05T23:17:01.760Z","cveId":"CVE-2026-88984","cweIds":["CWE-285","CWE-863"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kubeflow Pipelines"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kubeflow Pipelines authorization bypass allows modifying shared pipelines","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-06T06:09:43.571Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-06T06:09:47.051Z","patchAvailable":null,"disclosureDate":"2026-11-05T23:17:01.760Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}