EUVD-2026-117826Published
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-88984 · CVE overview and exploitation status
cve-program · CVE-2026-88984
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687
- https://github.com/kubeflow/pipelines/pull/13288
- https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c
- https://github.com/kubeflow/pipelines/releases/tag/2.16.1
euvd · EUVD-2026-117826
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687
- https://github.com/kubeflow/pipelines/pull/13288
- https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c
- https://github.com/kubeflow/pipelines/releases/tag/2.16.1
nvd · CVE-2026-88984
- https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c
- https://github.com/kubeflow/pipelines/pull/13288
- https://github.com/kubeflow/pipelines/releases/tag/2.16.1
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687
osv · GHSA-ghgh-57qv-h687
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687
- https://nvd.nist.gov/vuln/detail/CVE-2026-88984
- https://github.com/kubeflow/pipelines/pull/13288
- https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c
- https://github.com/kubeflow/pipelines
- https://github.com/kubeflow/pipelines/releases/tag/2.16.1
Related changes
Linked by CVE identifier- Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for m… · Advisory content revised · 11 Nov 2026
- Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines · Newly collected advisory · 9 Nov 2026
- Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines · Newly collected advisory · 5 Nov 2026