CVE-2026-91925

Polyaxon through version 2.16.4 renders operation specification fields — including queue, namespace, conditions, presets, and dependencies — using an unsandboxed Jinja2 template environment during server-side run preparation. An authenticated user can submit a run containing Jinja2 template-injection payloads in these fields, which are evaluated by the server and result in arbitrary operating-system command execution in the scheduler process context. Successful exploitation exposes database credentials and service tokens accessible to that process, effectively compromising the Polyaxon control plane and potentially the underlying cluster. Any self-hosted Polyaxon deployment up to and including 2.16.4 that allows run submission by untrusted or semi-trusted users (for example, multi-tenant ML teams) is affected. No public proof of concept is known and there is no evidence of in-the-wild exploitation, though the issue is rated high (CVSS 4.0: 8.7).

What to do: Upgrade Polyaxon to a release newer than 2.16.4 as soon as a fixed version is available and monitor the vendor's advisories. In the interim, restrict access to the Polyaxon API and run-submission endpoints to trusted users only, enforce strict RBAC/tenant separation, and review submitted run specifications for Jinja2 template syntax. If untrusted users could submit runs on an affected instance, rotate database credentials and service tokens and audit scheduler logs for unexpected command execution.