CVE-2026-88982: Kubeflow Pipelines execution cache exposes cached outputs across namespaces

Summary

Kubeflow Pipelines versions before 2.18.0 have a flaw in the legacy V1/raw-Argo execution cache, where the mutating webhook and cache-server storage path hash template fields without the Kubernetes namespace and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation. In multi-user deployments sharing the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed outputs substituted into a later step. Standard KFP V2 component pods bypass this cache, and arbitrary code execution or availability impact is not established.

Mitigation

Fixed in version 2.18.0.

Related items

• MediumChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationSimilar attack · Check Point Research
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog