{"id":"EM-20261105-WHNA","url":"https://cyber.eventmonitor.net/incident/EM-20261105-WHNA/kubeflow-pipelines-vulnerability-cve-2026-88984/","type":"cve","title":"Kubeflow Pipelines Vulnerability (CVE-2026-88984)","subtitle":"CVE-2026-88984","subject":"CVE-2026-88984","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T23:17:01.760Z","firstSignal":"2026-11-05T22:13:12.000Z","lastSignal":"2026-11-05T23:17:01.760Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T23:17:01.760Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T23:17:01.760Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T22:13:12.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T23:17:01.760Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-WHNA created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T23:17:01.760Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T23:17:01.760Z","detail":"CVSS 7.2"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T22:13:12.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T22:13:12.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-88984 (important)","text":"github.com/kubeflow/pipelines: Kubeflow Pipelines: Unauthorized modification of shared pipelines via authorization bypass","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-88984.json"},{"at":"2026-11-05T23:17:01.760Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-88984 (CVSS 7.2)","text":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88984"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T23:17:01.760","score":7.2,"severity":"HIGH","desc":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user…","product":"","seen":1793930371444},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}