Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, m
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Kubeflow
- Product
- pipelines
- CVSS v3.1
- 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Fix
- available
- Weakness
- CWE-345, CWE-639
- Exposure class
- Developer platform, AI infrastructure
- NVD status
- Received
Why it ranks 28 (Notable)
- CVSS v3.1 5.4 medium
- Product class: developer platform, AI infrastructure
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-88982 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.