CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Apache YuniKorn's LDAP group resolver can panic on a lowercase memberOf attribute before version 1.10.0.
24
CVE-2026-78243
LDAP group resolver crash in Apache YuniKorn
- CVSS 4.0
- 2.1 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache YuniKorn 1.8.0 and later can crash when the non-default LDAP group resolver processes a user's group membership. If LDAP returns a memberOf entry for a user named on a pod and that membership record does not start with "CN=", the server performs an out-of-bounds read and crashes. The impact is limited availability loss (a scheduler crash), not confidentiality or integrity compromise, and only clusters that explicitly enable the LDAP group provider are affected. CVSS 4.0 rates this 2.1 (low). It is not in CISA KEV and no public proof-of-concept is known; version 1.10.0 fixes the issue.
What to do: Upgrade Apache YuniKorn to 1.10.0. Until then, check whether the non-default LDAP group provider is enabled; installs using the default group resolver are not affected. If LDAP group resolution must stay on, ensure returned memberOf values begin with "CN=" and limit who can specify users on pods that trigger group lookup.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache YuniKorn | 1.8.0 and later, before 1.10.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=". This only affects install that have the non default LDAP group provider configured. Users are recommended to upgrade to version 1.10.0, which fixes this issue.
- Weakness
- CWE-248
- Vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:H/U:Green