Kubeflow Pipelines (Data Science Pipelines V1 API Argo Workflow spec path): The V1 API path accepts an arbitrary Argo

Impact

The V1 API path accepts an arbitrary Argo Workflow spec and skips the V2 security hardening entirely, so the pipelines API server acts as a confused deputy and creates privileged pods on the submitter's behalf. A tenant holding only namespace edit rights escalates to root on the underlying node, which on a GPU box means access to every other tenant's containers and to the device nodes they are using.

Who can reach it

A user with namespace editor privileges in a Data Science Pipelines / Kubeflow Pipelines namespace, submitting through the legacy V1 API endpoint.

What to do

Apply the Red Hat OpenShift AI errata (RHSA-2026:53261/53262/53263) and restart the pipelines API server. If you run upstream Kubeflow Pipelines, disable or gate the V1 API path and enforce pod restrictions with an admission policy rather than relying on the API server's own hardening.

References