CVE-2026-88982 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
In multi-user Kubeflow Pipelines deployments, the legacy V1 execution cache keys lookups without the namespace and trusts a mutable annotation. A tenant who can submit workloads can read another namespace's cached outputs or seed outputs that get substituted into a later pipeline step.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Exposure needs a multi-user Kubeflow Pipelines deployment where tenant namespaces share the execution cache service, and a tenant with workload-submission rights. Standard KFP V2 component pods bypass this cache, so single-tenant installs and V2-only pipelines are unlikely to be affected. Teams running only V2 components can deprioritize it.
Not affected if default-config, kfp-v2-only, single-tenant
Who cares kubeflow-pipelines, kubernetes, machine-learning, multi-tenant
2.18.02.18.0Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.