CVE-2026-88982

Kubeflow’s legacy execution cache crosses namespace boundaries

Kubeflow · Kubeflow Pipelines legacy V1/raw-Argo cache

First documented disclosure · Review checkpoint

Summary

A tenant can receive or replace cached outputs used by another namespace.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: Source review and regression tests establish the flaw; tests used fake Kubernetes clients, not a live tenant compromise. Malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Cache keys omit namespace and storage trusts a mutable pod annotation; reads and writes lack independent tenant ownership.

Conditions required

Mutually untrusted namespaces share the legacy cache; matching cache-relevant templates and acceptable staleness permit reuse.

Potential impact

Selective cached-output disclosure or substitution. Arbitrary code execution is not established; native V2 caching is outside scope.

Affected versions and configurations

KFP releases through 2.17.3 using the legacy cache.

Fix and mitigation status

2.18.0 enforces namespaced cache identities and excludes unowned historical rows in enforce mode.

Practical next steps

Upgrade every cache writer and ensure all old processes exit. Keep KFP_SECURITY_LEGACY_CACHE_MODE=enforce; audit mode intentionally accepts residual cross-tenant risk. Expect lower cache reuse.

Operating lesson

Tenant identity belongs in cache storage checks as well as cache keys.

Evidence and limits

September 10 public patch; October 28 advisory/release; November 5 CVE. Do not infer namespace ownership for old entries. Mixed old/new writers and explicit audit fallback are not full remediation; the fix does not undo prior disclosures.

Sources