{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88982", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-10T16:02:31.342Z", "datePublished": "2026-11-05T22:25:58.995Z", "dateUpdated": "2026-11-05T22:25:58.995Z"}, "containers": {"cna": {"title": "Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5"}, {"name": "https://github.com/kubeflow/pipelines/pull/14359", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/pull/14359"}, {"name": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e"}, {"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"}], "affected": [{"vendor": "kubeflow", "product": "pipelines", "versions": [{"version": "< 2.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:25:58.995Z"}, "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0."}], "source": {"advisory": "GHSA-2xwh-426q-42c5", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "pipelines", "vendor": "kubeflow", "versions": [{"status": "affected", "version": "< 2.18.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0."}], "id": "CVE-2026-88982", "lastModified": "2026-11-06T21:40:43.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-05T23:17:01.600", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/pull/14359"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/kubeflow/pipelines: Kubeflow Pipelines: Cross-tenant data disclosure via missing namespace in execution cache keys", "id": "2567963", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567963"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-524", "details": ["A flaw was found in Kubeflow Pipelines. The execution cache service generates cache keys without including the Kubernetes namespace, allowing cached data to be accessed across tenant boundaries. In multi-tenant environments sharing the cache service, an authenticated user with workload submission privileges can exploit this issue to access another namespace's cached outputs or inject crafted outputs into subsequent pipeline steps."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-88982", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-api-server-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-driver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-launcher-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-11-05T22:25:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88982\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88982\nhttps://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e\nhttps://github.com/kubeflow/pipelines/pull/14359\nhttps://github.com/kubeflow/pipelines/releases/tag/2.18.0\nhttps://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5"], "statement": "This vulnerability is rated as having a Moderate severity for Red Hat OpenShift AI because exploitation requires authenticated workload submission privileges within a shared multi-tenant cluster and is constrained to workflow step output poisoning or leakage without granting cluster takeover or code execution. The issue specifically affects deployments running legacy Argo-based pipeline definitions that share a centralized execution caching service across distinct namespaces. Modern pipeline v2 components bypass this legacy caching infrastructure, which limits exposure under standard pipeline workloads.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.18.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pipelines", "source": "cna", "vendor": "kubeflow"}, "product": "pipelines", "vendor": "kubeflow"}], "created": "2026-11-05T23:45:07.419575+00:00", "updated": "2026-11-06T15:00:07.992949+00:00", "vendors": ["kubeflow", "kubeflow$PRODUCT$pipelines"]}