MediumVulnerability
CVE-2026-88984: Kubeflow Pipelines authorization bypass allows modifying shared pipelines
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-88984
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Kubeflow Pipelines versions prior to 2.16.1 let the multi-user API server skip authorization for modification and deletion of shared or global pipelines, which use an empty namespace. An authenticated user without the required Kubernetes RBAC permissions can change or delete shared pipeline definitions and versions, harming their integrity and availability. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not fixed by 2.16.1.
Mitigation
Fixed in version 2.16.1.