CVE-2026-88982: Cross-Tenant Execution Cache Poisoning and Output Substitution in Kubeflow Pipelines

Vulnerability ID: CVE-2026-88982
CVSS Score: 5.4
Published: 2026-11-09

CVE-2026-88982 (GHSA-2xwh-426q-42c5) is an authorization bypass and data integrity vulnerability affecting Kubeflow Pipelines versions prior to 2.18.0. The flaw resides in the legacy V1 and raw-Argo execution caching mutating admission webhook and the associated cache-server storage backend. In multi-tenant deployments where namespaces share a centralized cache service, execution cache keys were derived solely from container specification fields without incorporating the workload's Kubernetes namespace. Additionally, the cache watcher trusted mutable pod annotations when persisting execution outputs. Consequently, an authenticated user with workload submission privileges in one tenant namespace can poison cached step outputs consumed by other tenants or read cached outputs generated by workloads in separate namespaces.

TL;DR

Kubeflow Pipelines prior to 2.18.0 fails to bind execution cache keys and database records to Kubernetes namespaces in its legacy V1/raw-Argo caching webhook, enabling cross-tenant cache poisoning and unauthorized output disclosure.

⚠️ Exploit Status: POC

Technical Details

  • CVE ID: CVE-2026-88982 (GHSA-2xwh-426q-42c5)
  • Weakness Class: CWE-639 (Authorization Bypass via Key) / CWE-345 (Insufficient Data Verification)
  • CVSS v3.1 Score: 5.4 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
  • EPSS Score: 0.15% (4.18th Percentile)
  • Affected Component: KFP V1 / raw-Argo Cache Mutating Webhook & Watcher (backend/src/cache)
  • Impact: Cross-tenant pipeline step output substitution and cached data disclosure
  • Exploit Status: PoC in unit/regression tests; no weaponized public exploit in the wild
  • Fixed Version: Kubeflow Pipelines 2.18.0

Affected Systems

  • Kubeflow Pipelines (Legacy V1 / raw-Argo Cache Server)
  • Kubeflow Pipelines: < 2.18.0 (Fixed in: 2.18.0)

Code Analysis

Commit: 620d0cc

Scope execution cache keys and storage by pod namespace to prevent cross-tenant cache poisoning and output substitution (PR #14359)

Mitigation Strategies

  • Upgrade Kubeflow Pipelines to version 2.18.0 or later to enforce namespace-scoped cache keys and database queries.
  • Disable the legacy execution cache MutatingWebhookConfiguration in multi-tenant clusters if immediate patching is not possible.
  • Keep the ALLOW_LEGACY_CACHE_FALLBACK environment variable disabled (false) after upgrading to prevent cross-tenant reads of historical unscoped cache entries.
  • Migrate workflows from legacy KFP V1 / raw Argo templates to KFP V2 components, which bypass the vulnerable webhook caching subsystem.

Remediation Steps:

  1. Scale the existing kubeflow-pipelines cache-server deployment to 0 replicas to prevent mixed-version database writes.
  2. Update the cache-server container image and Kubeflow Pipelines control plane manifests to release 2.18.0.
  3. Verify that the ALLOW_LEGACY_CACHE_FALLBACK environment variable is not enabled on the cache-server deployment.
  4. Start the 2.18.0 cache-server pod and monitor startup logs to confirm successful completion of the GORM database schema migration (creation of the Namespace column and idx_cache_namespace_key index).
  5. Monitor cache-server logs for 'execution cache key does not match namespace and template' errors, which indicate attempted annotation tampering.

References

Read the full report for CVE-2026-88982 on our website for more details including interactive diagrams and full exploit analysis.