Skip to content
NewA calmer, faster ZeroHour
Vulnerability7 · 2 reads

CVE-2026-97146

Admission-control bypass in Apache YuniKorn via label forgery

CVSS 4.0
4.8 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-97146 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache YuniKorn 1.9.0 and earlier skips checks on the user-info annotation when a pod also has the label app=yunikorn, a label meant to identify the YuniKorn application itself. A user who can create pods can set that label and supply arbitrary user information, bypassing admission controls that would otherwise limit the annotation. That can place the workload in a queue the user should not access, distort that queue’s quota usage, or sidestep user-based quota tracking even when the queue is correct. Clusters running YuniKorn 1.9.0 or earlier are affected; version 1.10.0 fixes the issue. There is no known public proof-of-concept and the CVE is not listed in CISA KEV.

What to do: Upgrade Apache YuniKorn to 1.10.0 or later. Until then, restrict who can create pods, and review pods that carry the app=yunikorn label but are not the scheduler itself for unexpected user-info annotations, queue placement, and user-quota accounting.

ProductAffected
Apache Software Foundation YuniKorn1.9.0 and earlier
Estimated exposure
nicheunknown (likely hundreds to low thousands of clusters, not internet-exposed at scale) — YuniKorn is a specialized in-cluster Kubernetes batch scheduler, not a default or internet-facing component, and no active-install counts or public scan totals were available.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments. The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.

Weakness
CWE-290
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story