Kubeflow Pipelines: RBAC authorization bypass for shared pipelines (CVE-2026-88984)
The Kubeflow Pipelines API server in multi-user mode skipped authorization checks for shared pipelines with an empty namespace, allowing authenticated users to modify or delete shared pipelines without required Kubernetes RBAC permissions.
CVE search metadata
CVE search record: CVE-2026-88984. EPSS: 0.31%. KEV: no. Product: go/github.com/kubeflow/pipelines (< 0.0.0-20260420170029-186dd1f3b040). Brief: Kubeflow Pipelines: RBAC authorization bypass for shared pipelines (CVE-2026-88984). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kubeflow-rbac-bypass/
Triage facts
Revision 1- Applicability
- go/github.com/kubeflow/pipelines (< 0.0.0-20260420170029-186dd1f3b040)
- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 04:16 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
In multi-user deployments, the Kubeflow Pipelines API server failed to validate authorization for shared or global pipelines that utilize an empty namespace. This defect permitted authenticated users to perform unauthorized write and delete operations on these pipelines. While read-only access remains permitted by design, this vulnerability impacts the integrity and availability of shared pipeline definitions. Single-user deployments do not utilize these multi-user authorization checks.