{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/go/github.com/kubeflow/pipelines--0.0.0-20260420170029-186dd1f3b040/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-88984"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["go/github.com/kubeflow/pipelines (\u003c 0.0.0-20260420170029-186dd1f3b040)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eIn multi-user deployments, the Kubeflow Pipelines API server failed to validate authorization for shared or global pipelines that utilize an empty namespace. This defect permitted authenticated users to perform unauthorized write and delete operations on these pipelines. While read-only access remains permitted by design, this vulnerability impacts the integrity and availability of shared pipeline definitions. Single-user deployments do not utilize these multi-user authorization checks.\u003c/p\u003e\n","date_modified":"2026-11-10T04:16:16Z","date_published":"2026-11-10T04:16:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kubeflow-rbac-bypass/","summary":"The Kubeflow Pipelines API server in multi-user mode skipped authorization checks for shared pipelines with an empty namespace, allowing authenticated users to modify or delete shared pipelines without required Kubernetes RBAC permissions.","title":"Kubeflow Pipelines: RBAC authorization bypass for shared pipelines (CVE-2026-88984)","url":"https://feed.craftedsignal.io/briefs/2026-11-kubeflow-rbac-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Go/Github.com/Kubeflow/Pipelines (\u003c 0.0.0-20260420170029-186dd1f3b040)","version":"https://jsonfeed.org/version/1.1"}