Vulnerabilitymedium
CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery
AI summary · grok-4.7Summaries by Vani AI
Apache YuniKorn before 1.10.0 lets privileged users bypass admission checks by forging the app=yunikorn label.
Apache YuniKorn before 1.10.0 can bypass admission checks that limit user-annotation content when a pod also carries the label app=yunikorn. The issue, CVE-2026-97146, is rated CVSS 4.0 4.8 (medium) and needs high privileges plus user interaction. The stated impact is low integrity only. Wilfred Spiegelenburg disclosed it on the oss-security list on October 7, 2026.
Key facts
- Affects Apache YuniKorn 1.9.0 and earlier; fixed in 1.10.0.
- Pods labeled app=yunikorn skip user-annotation admission checks.
- CVSS 4.0 is 4.8, requiring high privileges and user interaction.
- Impact is low integrity only, with no confidentiality or availability loss.
- CVEs
- CVE-2026-97146
- Vendors
- Apache
- Products
- Apache YuniKorn
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97146 | Admission-control bypass in Apache YuniKorn via label forgery | 4.8 | — |
From the original article
Posted by Wilfred Spiegelenburg on Oct 07 Severity: CVSS 4. 0: 4. 8 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.