CVE-2026-88984

Kubeflow shared-pipeline changes bypass write authorization

Kubeflow · Kubeflow Pipelines multi-user shared pipelines

First documented disclosure · Review checkpoint

Summary

An authenticated user can modify or delete shared definitions without the required permission.

Severity and exploitation evidence

High · 7.2/10 · CVSS 4.0. Severity source.

Exploitation not established: The maintainer documents the authorization defect; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The empty namespace exception skips RBAC for writes/deletes as well as intentionally public reads.

Conditions required

Authenticated access to the multi-user API and a shared/global pipeline.

Potential impact

Unauthorized changes or deletion. Execution of changed definitions is a conditional later consequence, not immediate worker execution.

Affected versions and configurations

KFP versions before 2.16.1.

Fix and mitigation status

2.16.1 checks shared writes against system-namespace RBAC; the separate upload flaw requires 2.18.0.

Practical next steps

Upgrade to a supported release covering both defects. Review shared definitions and restrict shared-pipeline writer permissions.

Operating lesson

Read access to a shared object must not imply write access.

Evidence and limits

April 20 public patch predates the September 14 advisory and November 5 CVE. Reads of shared pipelines remain intentionally allowed. The 2.16.1 fix is issue-specific and must not be presented as fixing all shared upload paths.

Sources