Lighthouse AdvisorySLED AI Adoption Intelligence
← Back to results

From the Red Hat edition of November 6, 2026

Vendor claimCautionaryNew this fortnight

CVE-2026-88985: Moderate Kubeflow Pipelines pagination-token disclosure across namespaces in OpenShift AI

Red Hat Product Security · Cross-sector technology vendor (OpenShift AI / Kubeflow Pipelines) · United States / global product

Red Hat
Publisher
Red Hat Customer Portal
Original publication
2026-11-05
Source retrieved
2026-11-07
Event date
2026-11-05
Read original source

What happened

Also public 2026-11-05, CVE-2026-88985 (Moderate, CVSS 6.5) covers Kubeflow Pipelines list APIs that trust decoded pagination-token fields when building database queries, allowing authenticated users who can list pipelines/runs to read records across namespaces. Red Hat explicitly maps the flaw to OpenShift AI multi-tenant Data Science Pipelines and notes it breaks application-level tenant data boundaries without enabling alteration or full system compromise. Same RHOAI odh-ml-pipelines-* packages show Under investigation; upstream references point to pipelines 2.17.0.

Why it matters

Reinforces that OpenShift AI shared research or agency MLOps platforms can leak pipeline/run metadata across departmental namespaces even when cluster RBAC looks correct. Especially relevant for higher-ed and state shared AI hubs that co-locate projects on one DSP control plane.

Evidence and measured results

Red Hat details/statement naming OpenShift AI, Moderate rating, CVSS 6.5 confidentiality-high, package_state Under investigation for odh-ml-pipelines-* images, references to GHSA-r4mx-2gr2-8277 and pipelines 2.17.0, no RHSA at inspection.

Limitations and uncertainty

Vendor assessment; Under investigation without errata. Does not claim cluster-admin escalation. Severity Moderate—pair with Important CVE-2026-88984 rather than treating alone as the headline.

Cross-source patterns this evidence supports

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-06; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway
Customer problem
Authenticated OpenShift AI users who can list pipelines may read other namespaces’ pipeline/run records via crafted pagination tokens.
Stakeholders
  • privacy officer
  • AI platform owner
  • research computing lead
Discovery questions
  • How many security domains share one DSP?
  • Who has pipeline list permissions?
  • Is pipeline metadata classified?
Value hypothesis
Tenancy redesign or faster patch uptake can restore intended namespace isolation for pipeline metadata.
Potential engagement
DSP tenancy and list-API review bundled with CVE-2026-88984 response.
Unsupported claims
  • Unauthenticated internet RCE
  • Guaranteed model-weight theft
  • Already Fixed in current RHOAI channel

Pre-sales engineering

Role takeaway
Fit
Multi-tenant OpenShift AI DSP where list APIs are broadly granted.
Architecture and integration
Tighten list RBAC; consider separate DSP per domain; pin to fixed images when available.
Prerequisites
  • RBAC export for pipeline verbs
  • namespace map of projects
Constraints
  • Under investigation
  • Moderate priority behind Important 88984
Security
Cross-namespace confidentiality break at application layer.
Proof of value
  • Cross-namespace list attempt fails post-control
  • Fixed digest deployed

Delivery

Role takeaway
Work
RBAC trim, tenant documentation, joint patch plan with 88984.
Dependencies
  • IdP/group mapping
  • RHSA
Ownership
AI platform security engineering
Skills and adoption
Platform team learns DSP API authz nuances.
Governance checkpoints
  • Privacy review of shared DSP
  • Patch CAB
Acceptance criteria
  • Documented list-verb matrix
  • Retest record after fix
Risks
  • Breaking dashboards that need broad list
  • Ignoring Important companion

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Do not treat DSP list APIs as tenant-safe by default. Prefer hard tenancy (separate DSP instances or clusters) for high-sensitivity SLED workloads until fixed builds arrive; minimize who receives pipeline list verbs.

Governance

Who approves, reviews and stays accountable for outcomes?

Data-classification owners should assume cross-project pipeline metadata may be readable by other authenticated DSP users until patched; update sharing agreements accordingly.

Security and privacy

What data, permissions and controls need testing?

Confidentiality impact on pipeline/run database records across namespaces; no integrity/availability in the vector. Still requires authentication and list permissions.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Not covered; reduces safe self-service listing of pipelines for citizen developers until fixed.

Procurement

What should contracts, pricing and exit terms secure?

Include cross-tenant DSP disclosure in security questionnaires for shared OpenShift AI offerings.

Operating model

Which teams own the service once it runs?

May push SLED operators toward separate DSP environments per agency/department, increasing operating cost.

Publication history

  1. 2026-11-06Red Hat · Issue 085 resources
Read preserved resource versions (JSON)

Stable resource ID: rhoai-cve-2026-88985-kfp-pagination-cross-namespace-disclosure-20261105