{"resourceId":"rhoai-cve-2026-88985-kfp-pagination-cross-namespace-disclosure-20261105","versions":[{"version":"external-c3cfa68439146021360dbae21605ff28444879ececf860cac0c49bdd5d139164","resource":{"id":"rhoai-cve-2026-88985-kfp-pagination-cross-namespace-disclosure-20261105","title":"CVE-2026-88985: Moderate Kubeflow Pipelines pagination-token disclosure across namespaces in OpenShift AI","organization":"Red Hat Product Security","sector":"Cross-sector technology vendor (OpenShift AI / Kubeflow Pipelines)","geography":"United States / global product","publishedAt":"2026-11-05","publicationDate":"2026-11-05","eventDate":"2026-11-05","sourceName":"Red Hat Customer Portal","sourceLabel":"Vendor CVE record: Moderate information disclosure via crafted pagination tokens on pipeline list APIs","sourceUrl":"https://access.redhat.com/security/cve/cve-2026-88985","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure","governance-procurement"],"finding":"Also public 2026-11-05, CVE-2026-88985 (Moderate, CVSS 6.5) covers Kubeflow Pipelines list APIs that trust decoded pagination-token fields when building database queries, allowing authenticated users who can list pipelines/runs to read records across namespaces. Red Hat explicitly maps the flaw to OpenShift AI multi-tenant Data Science Pipelines and notes it breaks application-level tenant data boundaries without enabling alteration or full system compromise. Same RHOAI odh-ml-pipelines-* packages show Under investigation; upstream references point to pipelines 2.17.0.","sledRelevance":"Reinforces that OpenShift AI shared research or agency MLOps platforms can leak pipeline/run metadata across departmental namespaces even when cluster RBAC looks correct. Especially relevant for higher-ed and state shared AI hubs that co-locate projects on one DSP control plane.","evidence":"Red Hat details/statement naming OpenShift AI, Moderate rating, CVSS 6.5 confidentiality-high, package_state Under investigation for odh-ml-pipelines-* images, references to GHSA-r4mx-2gr2-8277 and pipelines 2.17.0, no RHSA at inspection.","architectureImplications":"Do not treat DSP list APIs as tenant-safe by default. Prefer hard tenancy (separate DSP instances or clusters) for high-sensitivity SLED workloads until fixed builds arrive; minimize who receives pipeline list verbs.","governanceImplications":"Data-classification owners should assume cross-project pipeline metadata may be readable by other authenticated DSP users until patched; update sharing agreements accordingly.","securityPrivacyImplications":"Confidentiality impact on pipeline/run database records across namespaces; no integrity/availability in the vector. Still requires authentication and list permissions.","caveats":"Vendor assessment; Under investigation without errata. Does not claim cluster-admin escalation. Severity Moderate—pair with Important CVE-2026-88984 rather than treating alone as the headline.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: Moderate but concrete cross-namespace pipeline metadata disclosure on OpenShift AI. Use it with CVE-2026-88984 to justify a tenancy design conversation—not a panic patch sale. Offer discovery on who holds pipeline list verbs and whether multiple agencies or research groups share one Data Science Pipelines control plane. Unsupported claims include unauthenticated RCE and guaranteed exfiltration of model weights or secrets from this CVE alone.","engineering":"Engineering framing: review pagination and list API exposure plus RBAC for pipeline list and get verbs across projects. Validate whether one Data Science Pipelines instance serves multiple security domains or agencies. Track upstream Kubeflow Pipelines 2.17.0 and future Red Hat OpenShift AI rebuilds. Proof of value is a negative cross-namespace list test after compensating controls or after upgrade to Fixed images when Red Hat publishes an RHSA.","delivery":"Delivery framing: add CVE-2026-88985 to the same Data Science Pipelines hardening ticket as CVE-2026-88984, document tenant metadata classification assumptions for each co-hosted project, and schedule a retest after Fixed images arrive from Red Hat. Delivery risks include over-scoping into unrelated cluster CVEs and delaying the Important integrity fix that should lead triage for shared OpenShift AI estates during this research week."},"roleDetails":{"sales":{"customerProblem":"Authenticated OpenShift AI users who can list pipelines may read other namespaces’ pipeline/run records via crafted pagination tokens.","stakeholders":["privacy officer","AI platform owner","research computing lead"],"discoveryQuestions":["How many security domains share one DSP?","Who has pipeline list permissions?","Is pipeline metadata classified?"],"valueHypothesis":"Tenancy redesign or faster patch uptake can restore intended namespace isolation for pipeline metadata.","potentialEngagement":"DSP tenancy and list-API review bundled with CVE-2026-88984 response.","unsupportedClaims":["Unauthenticated internet RCE","Guaranteed model-weight theft","Already Fixed in current RHOAI channel"]},"engineering":{"fit":"Multi-tenant OpenShift AI DSP where list APIs are broadly granted.","architectureIntegration":"Tighten list RBAC; consider separate DSP per domain; pin to fixed images when available.","prerequisites":["RBAC export for pipeline verbs","namespace map of projects"],"constraints":["Under investigation","Moderate priority behind Important 88984"],"security":"Cross-namespace confidentiality break at application layer.","proofOfValue":["Cross-namespace list attempt fails post-control","Fixed digest deployed"]},"delivery":{"work":"RBAC trim, tenant documentation, joint patch plan with 88984.","dependencies":["IdP/group mapping","RHSA"],"ownership":"AI platform security engineering","skillsAdoption":"Platform team learns DSP API authz nuances.","governanceCheckpoints":["Privacy review of shared DSP","Patch CAB"],"acceptanceCriteria":["Documented list-verb matrix","Retest record after fix"],"risks":["Breaking dashboards that need broad list","Ignoring Important companion"]}},"retrievedAt":"2026-11-06T22:12:38-06:00","enrichedAt":"2026-11-06T22:12:38-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not covered; reduces safe self-service listing of pipelines for citizen developers until fixed.","procurementImplications":"Include cross-tenant DSP disclosure in security questionnaires for shared OpenShift AI offerings.","operatingModelImplications":"May push SLED operators toward separate DSP environments per agency/department, increasing operating cost.","sourceVerification":{"openedUrl":"https://access.redhat.com/security/cve/cve-2026-88985","referenceExcerpt":"authenticated users permitted to query pipeline and run listing endpoints can manipulate pagination tokens to read database records across namespaces","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}