EUVD-2026-117831Published
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-88982 · CVE overview and exploitation status
cve-program · CVE-2026-88982
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5
- https://github.com/kubeflow/pipelines/pull/14359
- https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
euvd · EUVD-2026-117831
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5
- https://github.com/kubeflow/pipelines/pull/14359
- https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
nvd · CVE-2026-88982
- https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e
- https://github.com/kubeflow/pipelines/pull/14359
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5
osv · GHSA-2xwh-426q-42c5
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5
- https://nvd.nist.gov/vuln/detail/CVE-2026-88982
- https://github.com/kubeflow/pipelines/pull/14359
- https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e
- https://github.com/kubeflow/pipelines
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0
Related changes
Linked by CVE identifier- Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without… · Advisory content revised · 11 Nov 2026
- Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) · Newly collected advisory · 9 Nov 2026
- Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) · Newly collected advisory · 5 Nov 2026