CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation
AI summary · grok-4.7Summaries by Vani AI
Apache YuniKorn before 1.10.0 skips admission checks when workloads are updated, rated CVSS 2.0.
Apache YuniKorn 1.9.0 and earlier does not apply label and user-annotation checks to workload UPDATE operations, bypassing admission controls. Workloads include Kubernetes objects such as Deployments and ReplicaSets. CVE-2026-92393 is scored CVSS 4.0 2.0 (low), with low integrity impact and no confidentiality or availability impact. The flaw is fixed in 1.10.0.
Key facts
- YuniKorn before 1.10.0 skips checks on workload UPDATE operations.
- Affected workloads include Deployments, ReplicaSets, and similar objects.
- CVE-2026-92393 is CVSS 4.0 2.0 with low integrity impact.
- Exploitation needs high privileges, user interaction, and extra conditions.
- CVEs
- CVE-2026-92393
- Vendors
- Apache
- Products
- Apache YuniKorn
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92393 | Workload UPDATE admission bypass in Apache YuniKorn | 2.0 | — |
From the original article
Posted by Wilfred Spiegelenburg on Oct 07 Severity: CVSS 4. 0: 2. 0 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.