CVE-2026-88984

{
  "etk_id": "ETK-2026-4009",
  "cve_id": "CVE-2026-88984",
  "display_id": "CVE-2026-88984",
  "ghsa_id": "GHSA-ghgh-57qv-h687",
  "euvd_id": "EUVD-2026-117826",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Shared pipeline authorization bypass in Kubeflow Pipelines",
  "summary": "Kubeflow Pipelines in multi-user deployments can fail to apply Kubernetes RBAC checks to changes or deletions of shared pipelines. An authenticated user without the required permissions can alter or remove shared pipeline definitions and versions. The affected resources are shared or global pipelines represented by an empty namespace; single-user deployments use a different authorization model.",
  "mitigation": "Upgrade github.com/kubeflow/pipelines to Go module version 0.0.0-20260420170029-186dd1f3b040 or later. Until upgraded, restrict Pipelines API access to trusted users through deployment-level access controls.",
  "vendor": "go",
  "product": "go:github.com/kubeflow/pipelines",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.0.0-20260420170029-186dd1f3b040"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "0.0.0-20260420170029-186dd1f3b040"
      ],
      "package_name": "github.com/kubeflow/pipelines",
      "purl": "pkg:golang/github.com/kubeflow/pipelines"
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0031,
  "epss_percentile": 0.2409,
  "epss_asof": "2026-11-09",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.020465183333332,
  "t0_at": "2026-11-05T22:13:12.954000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T22:13:12.954000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T22:13:12.954000+00:00",
      "url": "https://github.com/advisories/GHSA-ghgh-57qv-h687"
    }
  }
}