{"resourceId":"rhoai-cve-2026-88984-kfp-shared-pipeline-rbac-bypass-20261105","versions":[{"version":"external-c3cfa68439146021360dbae21605ff28444879ececf860cac0c49bdd5d139164","resource":{"id":"rhoai-cve-2026-88984-kfp-shared-pipeline-rbac-bypass-20261105","title":"CVE-2026-88984: Important Kubeflow Pipelines RBAC bypass on shared pipelines in Red Hat OpenShift AI","organization":"Red Hat Product Security","sector":"Cross-sector technology vendor (OpenShift AI / Kubeflow Pipelines)","geography":"United States / global product","publishedAt":"2026-11-05","publicationDate":"2026-11-05","eventDate":"2026-11-05","sourceName":"Red Hat Customer Portal","sourceLabel":"Vendor CVE record: Important severity, RHOAI packages Under investigation, no official mitigation meeting RH criteria","sourceUrl":"https://access.redhat.com/security/cve/cve-2026-88984","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security","developers-agents","governance-procurement"],"finding":"On 2026-11-05 Red Hat published CVE-2026-88984 (Important, CVSS 8.1) for Kubeflow Pipelines: in multi-user deployments the API server fails to enforce authorization on shared/global pipelines with an empty namespace, so an authenticated user can modify or delete shared pipeline definitions without required RBAC. Red Hat states the issue affects Red Hat OpenShift AI Data Science Pipelines packages (odh-ml-pipelines-*), with fix_state Under investigation and no product advisory yet. Upstream fixed in Kubeflow Pipelines 2.16.1; Red Hat lists no easy mitigation meeting its criteria, while 2026-11-06 CME guidance recommends restricting API-server access and auditing shared pipeline changes until patched.","sledRelevance":"SLED OpenShift AI estates that share Data Science Pipelines across projects or tenants face integrity and availability risk to common training/inference workflows. Multi-tenant university research clusters and state shared-services AI platforms are the primary exposure pattern; single-user DSP deployments are out of scope per Red Hat. Relevance is operational security, not a measured SLED outage.","evidence":"Red Hat CVE details, Important statement naming OpenShift AI shared Kubeflow Pipelines, CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), package_state Under investigation for five rhoai/odh-ml-pipelines-* images, empty affected_release/advisory list, mitigation text with CME guidance 2026-11-06, upstream references to GHSA-ghgh-57qv-h687 and pipelines 2.16.1.","architectureImplications":"Treat shared/global pipeline registries as a high-trust control plane. Prefer per-project pipelines over empty-namespace shared definitions until fixed builds ship; isolate DSP API-server NetworkPolicies to admin/CI identities; do not expose the pipelines API across tenant boundaries.","governanceImplications":"Change-control should require dual review for any shared pipeline create/update/delete. Track Red Hat fix_state until an RHSA moves packages from Under investigation to Fixed; document compensating access restrictions as temporary ATO evidence.","securityPrivacyImplications":"Integrity/availability focused (no confidentiality impact in CVSS). Authenticated low-privilege users can destroy or alter shared ML workflows used by other agencies or research groups. No public in-the-wild exploitation claimed.","caveats":"Vendor CNA assessment, not an independent exploit write-up. Packages remain Under investigation—no Red Hat errata at inspection time. CME mitigation block is AI-assisted courtesy guidance Red Hat says customers must evaluate themselves. Transferability depends on whether the estate uses multi-user shared pipelines.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: multi-tenant OpenShift AI shared-pipeline risk after a fresh Important CVE. CISOs and AI platform owners need a bounded discovery—whether Data Science Pipelines runs multi-user with shared/global definitions—and a compensating-control offer while packages stay Under investigation. Do not promise a Red Hat errata date; sell a short RBAC and NetworkPolicy review tied to CVE-2026-88984, with clear language that single-user DSP is out of scope per the vendor statement.","engineering":"Engineering framing: confirm multi-user Kubeflow Pipelines / OpenShift AI DSP and whether empty-namespace shared pipelines exist. Map who can reach the pipelines API server; enforce NetworkPolicy where possible; inventory odh-ml-pipelines-* image digests against future RHSAs. Upstream 2.16.1 is the known fixed line—wait for Red Hat rebuilds before production upgrade claims. Proof of value is absence of unauthorized shared-pipeline mutations in audit logs under a controlled test account.","delivery":"Delivery framing: open a vulnerability ticket for CVE-2026-88984, freeze ad-hoc shared pipeline edits, assign an owner for the shared catalog, and add monitoring for pipeline definition changes. Acceptance is documented API-server access restriction plus a tested upgrade plan to the fixed OpenShift AI build when published. Risks include breaking legitimate shared workflows during lockdown and operators assuming Moderate companions are the only issue."},"roleDetails":{"sales":{"customerProblem":"Authenticated users on shared OpenShift AI Data Science Pipelines may alter or delete global pipeline definitions without proper RBAC.","stakeholders":["CISO","AI platform owner","MLOps lead","shared-services IT"],"discoveryQuestions":["Is DSP deployed multi-user with shared/global pipelines?","Which namespaces can reach the pipelines API server?","Who owns changes to shared pipeline catalogs today?"],"valueHypothesis":"A short shared-pipeline access review can reduce unauthorized mutation risk until Red Hat ships fixed images; benefit size depends on tenancy design.","potentialEngagement":"3–5 day OpenShift AI DSP tenancy and RBAC assessment keyed to CVE-2026-88984.","unsupportedClaims":["Red Hat has already shipped a fixed OpenShift AI advisory","Single-user DSP deployments are affected","Guaranteed prevention without the upstream/Red Hat patch"]},"engineering":{"fit":"OpenShift AI clusters running multi-user Data Science Pipelines with shared or empty-namespace pipeline resources.","architectureIntegration":"Constrain DSP API paths with NetworkPolicy; prefer namespaced pipelines; align image pins to future RHSA digests.","prerequisites":["Inventory of odh-ml-pipelines-* images","List of shared/global pipeline objects","Cluster admin access for NetworkPolicy/RBAC review"],"constraints":["Packages Under investigation—no RHSA yet","Official mitigation unavailable per Red Hat criteria","Upstream 2.16.1 may not match supported RHOAI channels"],"security":"Important integrity/availability bypass for authenticated users; confidentiality not scored in CVSS vector.","proofOfValue":["Test account without edit roles cannot mutate shared pipelines after controls","Audit log shows denied or absent unauthorized writes","Image digests recorded for comparison to future Fixed advisories"]},"delivery":{"work":"Ticket CVE, restrict DSP API access, inventory shared pipelines, prepare upgrade runbook for fixed builds.","dependencies":["OpenShift AI operator channel","change window","RHSA publication"],"ownership":"AI platform / cluster operations with security oversight","skillsAdoption":"Platform engineers need DSP RBAC and NetworkPolicy fluency; researchers need alternate per-project pipeline patterns.","governanceCheckpoints":["ATO/security approval of compensating controls","Change board for shared catalog freezes","Re-open when RHSA marks Fixed"],"acceptanceCriteria":["Documented API-server access allow-list","Shared pipeline change monitoring enabled","Tracked watch for RHSA covering CVE-2026-88984"],"risks":["Lockdown blocks legitimate shared MLOps","Operators wait indefinitely without watching package_state","Assuming companions Moderate issues are sufficient triage"]}},"retrievedAt":"2026-11-06T22:12:35-06:00","enrichedAt":"2026-11-06T22:12:35-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed in the source; patching and access reviews fall on platform/security staff rather than end users.","procurementImplications":"Ask OEMs/resellers when fixed OpenShift AI DSP builds will be on the authorized schedule; do not treat Under investigation as Fixed in contract acceptance.","operatingModelImplications":"Until patched, shared pipeline catalogs need an owner of record and monitored change tickets; temporary lockdown of who can reach the DSP API may slow citizen-developer MLOps.","sourceVerification":{"openedUrl":"https://access.redhat.com/security/cve/cve-2026-88984","referenceExcerpt":"This vulnerability is rated as Important because any authenticated user in a multi-tenant environment can bypass access controls","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}