Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Affects Kubeflow Pipelines in multi-user mode, where shared/global pipelines with an empty namespace can be modified or deleted by any authenticated user. Fixed in 2.16.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.16.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Multi-user mode of the Kubeflow Pipelines API server Target is a shared/global pipeline with an empty namespace
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Kubeflow Pipelines, a platform for building and deploying machine learning workflows, has a flaw in its multi-user API server that lets any authenticated user modify or delete shared pipelines they lack Kubernetes RBAC permissions for. An attacker can reach it remotely over the network with low-privilege login and no user interaction, and can tamper with or remove pipeline definitions and versions, affecting their integrity and availability.
Read the original description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.2/10CVSS 7.2
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Multi-user mode of the Kubeflow Pipelines API server Target is a shared/global pipeline with an empty namespaceUpgrade to a fixed version: 2.16.1.
A source says this fix is incomplete.Workaround: Restrict access to the Pipelines API to trusted users through deployment-level access controls.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- kubeflow pipelines
fixed in 2.16.1
Evidence 4
- Advisory
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-88984
Is CVE-2026-88984 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
In multi-user mode, the Pipelines API server skipped authorization checks, so any authenticated user could change or delete shared pipelines. Unauthorized changes can alter shared pipeline definitions and versions, and deletions can make shared pipelines unavailable.Source: github.com
Which versions are affected by CVE-2026-88984?
pipelines: before 2.16.1.Source: cve.now feed data
Am I affected, and how do I check?
The issue affects Kubeflow Pipelines versions before 2.16.1 when running in multi-user mode, and targets shared/global pipelines with an empty namespace. To check, confirm the deployed Pipelines version and whether the API server runs in multi-user mode in its deployment configuration.Source: github.com
How do I fix CVE-2026-88984?
Upgrade Kubeflow Pipelines to 2.16.1 or later. The fix is included in 2.16.1.Source: github.com
Is the fix complete?
The fix is recorded as partial, but the available facts do not say which part remains unfixed. Check the advisory for the list of remaining gaps.Source: github.com