---
id: CVE-2026-88984
title: >-
  Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated
  user to delete or modify global pipelines
summary: >-
  Kubeflow Pipelines enables users to build and deploy portable, scalable
  machine learning workflows. Prior to 2.16.1, the multi-user API server treats
  the empty namespace used by shared or global pipelines as an authorization
  exception fo…
severity: high
cvss: 7.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-285
  - CWE-863
vendor: kubeflow
product: pipelines
affected:
  - pipelines < 2.16.1
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:13:12.954Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88984'
references:
  - url: >-
      https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687
    label: >-
      https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687
  - url: 'https://github.com/kubeflow/pipelines/pull/13288'
    label: 'https://github.com/kubeflow/pipelines/pull/13288'
  - url: >-
      https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c
    label: >-
      https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c
  - url: 'https://github.com/kubeflow/pipelines/releases/tag/2.16.1'
    label: 'https://github.com/kubeflow/pipelines/releases/tag/2.16.1'
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.951Z'
---

## Overview

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1.

## Affected

- `pipelines < 2.16.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.