Is CVE-2026-88984 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88984 being exploited in the wild.

How severe is CVE-2026-88984?

High severity, with a CVSS score of 4, published 5 November 2026.

Which products and versions are affected?

github.com/kubeflow/pipelines (Go) < 0.0.0-20260420170029-186dd1f3b040, SEMVER:introduced=0,fixed=0.0.0-20260420170029-186dd1f3b040; Kubeflow Pipelines prior to 2.16.1.

Is there a fix for CVE-2026-88984?

Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260420170029-186dd1f3b040 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88984 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88984?

Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88984: Kubeflow Pipelines authorization bypass in shared pipelines

Q: Is there a fix for CVE-2026-88984?

Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260420170029-186dd1f3b040 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-88984 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-88984?

Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88984 · Severity: high · CVSS 4 · Published 2026-11-05

Kubeflow Pipelines is a platform for building machine learning workflows. In versions before 2.16.1, authenticated users could modify or delete shared pipeline definitions and versions even without the proper access permissions, potentially corrupting or disabling critical ML workflows. This vulnerability affects multi-user deployments where shared pipelines are used for collaboration across teams.

Technologies: github.com/kubeflow/pipelines (Go), Kubeflow Pipelines. Vendors: Go, Kubeflow.

Quick answers

Is CVE-2026-88984 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88984 being exploited in the wild.
How severe is CVE-2026-88984?: High severity, with a CVSS score of 4, published 5 November 2026.
Which products and versions are affected?: github.com/kubeflow/pipelines (Go) < 0.0.0-20260420170029-186dd1f3b040, SEMVER:introduced=0,fixed=0.0.0-20260420170029-186dd1f3b040; Kubeflow Pipelines prior to 2.16.1.
Is there a fix for CVE-2026-88984?: Yes. github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260420170029-186dd1f3b040 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88984 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88984?: Check whether you run github.com/kubeflow/pipelines (Go) or Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubeflow/pipelines (Go): upgrade to 0.0.0-20260420170029-186dd1f3b040 or later
```
go get github.com/kubeflow/pipelines@v0.0.0-20260420170029-186dd1f3b040
```

Technical details

The multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception, allowing authenticated users to bypass Kubernetes RBAC checks for modify and delete operations. The vulnerability exists in the pipeline_server authorization logic, which only enforces RBAC for read operations on shared pipelines. An authenticated user (no elevated privileges required) can trigger this via standard API calls to create, update, or delete shared pipeline definitions.

Affected products

Kubeflow Pipelines prior to 2.16.1

Identifiers

CVE-2026-88984
GHSA-ghgh-57qv-h687

Timeline

2026-11-05: disclosed
2026-04-20: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.