Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Apache YuniKorn 1.10.0 fixes three admission and LDAP flaws

1 source · 3 articlesFirst reported Updated ()3
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache YuniKorn 1.10.0 fixes three CVEs: an LDAP panic and two admission-control bypasses, disclosed October 7, 2026.

On October 7, 2026, oss-security published three Apache YuniKorn advisories, each fixed in version 1.10.0. CVE-2026-78243 affects 1.8.0 and later before 1.10.0: the LDAP group resolver can panic from an out-of-bounds read when a memberOf attribute name is lowercase, scored CVSS 4.0 2.1 (low) with low availability impact, high attack complexity, and high recovery effort. CVE-2026-92393, in 1.9.0 and earlier, skips label and user-annotation checks on workload UPDATE operations such as Deployments and ReplicaSets; it is scored CVSS 4.0 2.0 with low integrity impact only and requires high privileges, user interaction, and extra conditions. CVE-2026-97146, also in 1.9.0 and earlier, lets a pod labeled app=yunikorn bypass user-annotation admission checks; Wilfred Spiegelenburg disclosed it, and it is scored CVSS 4.0 4.8 (medium) with low integrity impact, high privileges, and user interaction. The reports do not disagree on scores or the 1.10.0 fix; stated affected-version floors differ by CVE.

Key facts
  • CVE-2026-78243 affects Apache YuniKorn 1.8.0 and later before 1.10.0 with LDAP groups enabled: an out-of-bounds read panics the scheduler when memberOf is returned in lowercase; CVSS 4.0 is 2.1 (low), with low availability impact, high…
  • CVE-2026-92393 affects YuniKorn 1.9.0 and earlier: label and user-annotation checks are skipped on workload UPDATE operations, including Deployments and ReplicaSets; CVSS 4.0 is 2.0 (low), with low integrity impact and no confidentiality…
  • Exploitation of CVE-2026-92393 needs high privileges, user interaction, and extra conditions.
  • CVE-2026-97146 affects YuniKorn 1.9.0 and earlier (before 1.10.0): pods labeled app=yunikorn bypass admission checks that limit user-annotation content; CVSS 4.0 is 4.8 (medium), with low integrity impact only, high privileges, and user…
  • All three flaws are fixed in Apache YuniKorn 1.10.0.
  • Wilfred Spiegelenburg disclosed CVE-2026-97146 on the oss-security list on October 7, 2026; all three advisories were posted that day.
Analyze CVE-2026-97146 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-97146CVE-2026-78243CVE-2026-92393
Vendors
Apache
Products
Apache YuniKorn
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · Oct 7, 2026 oss-securityFirst report

    CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name

    Apache YuniKorn's LDAP group resolver can panic on a lowercase memberOf attribute before version 1.10.0.

  2. · Oct 7, 2026 oss-security

    CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation

    Apache YuniKorn before 1.10.0 skips admission checks when workloads are updated, rated CVSS 2.0.

  3. · Oct 7, 2026 oss-security

    CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery

    Apache YuniKorn before 1.10.0 lets privileged users bypass admission checks by forging the app=yunikorn label.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-78243
LDAP group resolver crash in Apache YuniKorn
2.1—
CVE-2026-97146
+1 related CVE
CVE-2026-92393
Admission-control bypass in Apache YuniKorn via label forgery
4.8
group max
—