Lighthouse AdvisorySLED AI Adoption Intelligence
← Back to results

From the Red Hat edition of November 6, 2026

Vendor claimCautionaryNew this fortnight

CVE-2026-88984: Important Kubeflow Pipelines RBAC bypass on shared pipelines in Red Hat OpenShift AI

Red Hat Product Security · Cross-sector technology vendor (OpenShift AI / Kubeflow Pipelines) · United States / global product

Red Hat
Publisher
Red Hat Customer Portal
Original publication
2026-11-05
Source retrieved
2026-11-07
Event date
2026-11-05
Read original source

What happened

On 2026-11-05 Red Hat published CVE-2026-88984 (Important, CVSS 8.1) for Kubeflow Pipelines: in multi-user deployments the API server fails to enforce authorization on shared/global pipelines with an empty namespace, so an authenticated user can modify or delete shared pipeline definitions without required RBAC. Red Hat states the issue affects Red Hat OpenShift AI Data Science Pipelines packages (odh-ml-pipelines-*), with fix_state Under investigation and no product advisory yet. Upstream fixed in Kubeflow Pipelines 2.16.1; Red Hat lists no easy mitigation meeting its criteria, while 2026-11-06 CME guidance recommends restricting API-server access and auditing shared pipeline changes until patched.

Why it matters

SLED OpenShift AI estates that share Data Science Pipelines across projects or tenants face integrity and availability risk to common training/inference workflows. Multi-tenant university research clusters and state shared-services AI platforms are the primary exposure pattern; single-user DSP deployments are out of scope per Red Hat. Relevance is operational security, not a measured SLED outage.

Evidence and measured results

Red Hat CVE details, Important statement naming OpenShift AI shared Kubeflow Pipelines, CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), package_state Under investigation for five rhoai/odh-ml-pipelines-* images, empty affected_release/advisory list, mitigation text with CME guidance 2026-11-06, upstream references to GHSA-ghgh-57qv-h687 and pipelines 2.16.1.

Limitations and uncertainty

Vendor CNA assessment, not an independent exploit write-up. Packages remain Under investigation—no Red Hat errata at inspection time. CME mitigation block is AI-assisted courtesy guidance Red Hat says customers must evaluate themselves. Transferability depends on whether the estate uses multi-user shared pipelines.

Cross-source patterns this evidence supports

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-06; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway
Customer problem
Authenticated users on shared OpenShift AI Data Science Pipelines may alter or delete global pipeline definitions without proper RBAC.
Stakeholders
  • CISO
  • AI platform owner
  • MLOps lead
  • shared-services IT
Discovery questions
  • Is DSP deployed multi-user with shared/global pipelines?
  • Which namespaces can reach the pipelines API server?
  • Who owns changes to shared pipeline catalogs today?
Value hypothesis
A short shared-pipeline access review can reduce unauthorized mutation risk until Red Hat ships fixed images; benefit size depends on tenancy design.
Potential engagement
3–5 day OpenShift AI DSP tenancy and RBAC assessment keyed to CVE-2026-88984.
Unsupported claims
  • Red Hat has already shipped a fixed OpenShift AI advisory
  • Single-user DSP deployments are affected
  • Guaranteed prevention without the upstream/Red Hat patch

Pre-sales engineering

Role takeaway
Fit
OpenShift AI clusters running multi-user Data Science Pipelines with shared or empty-namespace pipeline resources.
Architecture and integration
Constrain DSP API paths with NetworkPolicy; prefer namespaced pipelines; align image pins to future RHSA digests.
Prerequisites
  • Inventory of odh-ml-pipelines-* images
  • List of shared/global pipeline objects
  • Cluster admin access for NetworkPolicy/RBAC review
Constraints
  • Packages Under investigation—no RHSA yet
  • Official mitigation unavailable per Red Hat criteria
  • Upstream 2.16.1 may not match supported RHOAI channels
Security
Important integrity/availability bypass for authenticated users; confidentiality not scored in CVSS vector.
Proof of value
  • Test account without edit roles cannot mutate shared pipelines after controls
  • Audit log shows denied or absent unauthorized writes
  • Image digests recorded for comparison to future Fixed advisories

Delivery

Role takeaway
Work
Ticket CVE, restrict DSP API access, inventory shared pipelines, prepare upgrade runbook for fixed builds.
Dependencies
  • OpenShift AI operator channel
  • change window
  • RHSA publication
Ownership
AI platform / cluster operations with security oversight
Skills and adoption
Platform engineers need DSP RBAC and NetworkPolicy fluency; researchers need alternate per-project pipeline patterns.
Governance checkpoints
  • ATO/security approval of compensating controls
  • Change board for shared catalog freezes
  • Re-open when RHSA marks Fixed
Acceptance criteria
  • Documented API-server access allow-list
  • Shared pipeline change monitoring enabled
  • Tracked watch for RHSA covering CVE-2026-88984
Risks
  • Lockdown blocks legitimate shared MLOps
  • Operators wait indefinitely without watching package_state
  • Assuming companions Moderate issues are sufficient triage

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Treat shared/global pipeline registries as a high-trust control plane. Prefer per-project pipelines over empty-namespace shared definitions until fixed builds ship; isolate DSP API-server NetworkPolicies to admin/CI identities; do not expose the pipelines API across tenant boundaries.

Governance

Who approves, reviews and stays accountable for outcomes?

Change-control should require dual review for any shared pipeline create/update/delete. Track Red Hat fix_state until an RHSA moves packages from Under investigation to Fixed; document compensating access restrictions as temporary ATO evidence.

Security and privacy

What data, permissions and controls need testing?

Integrity/availability focused (no confidentiality impact in CVSS). Authenticated low-privilege users can destroy or alter shared ML workflows used by other agencies or research groups. No public in-the-wild exploitation claimed.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Not addressed in the source; patching and access reviews fall on platform/security staff rather than end users.

Procurement

What should contracts, pricing and exit terms secure?

Ask OEMs/resellers when fixed OpenShift AI DSP builds will be on the authorized schedule; do not treat Under investigation as Fixed in contract acceptance.

Operating model

Which teams own the service once it runs?

Until patched, shared pipeline catalogs need an owner of record and monitored change tickets; temporary lockdown of who can reach the DSP API may slow citizen-developer MLOps.

Publication history

  1. 2026-11-06Red Hat · Issue 085 resources
Read preserved resource versions (JSON)

Stable resource ID: rhoai-cve-2026-88984-kfp-shared-pipeline-rbac-bypass-20261105