Go/Github.com/Kubeflow/Pipelines (< 0.0.0-20260420170029-186dd1f3b040) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/go/github.com/kubeflow/pipelines--0.0.0-20260420170029-186dd1f3b040/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 04:16:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKubeflow Pipelines: RBAC authorization bypass for shared pipelines (CVE-2026-88984)https://feed.craftedsignal.io/briefs/2026-11-kubeflow-rbac-bypass/Tue, 10 Nov 2026 04:16:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kubeflow-rbac-bypass/The Kubeflow Pipelines API server in multi-user mode skipped authorization checks for shared pipelines with an empty namespace, allowing authenticated users to modify or delete shared pipelines without required Kubernetes RBAC permissions.<p>In multi-user deployments, the Kubeflow Pipelines API server failed to validate authorization for shared or global pipelines that utilize an empty namespace. This defect permitted authenticated users to perform unauthorized write and delete operations on these pipelines. While read-only access remains permitted by design, this vulnerability impacts the integrity and availability of shared pipeline definitions. Single-user deployments do not utilize these multi-user authorization checks.</p> highadvisory