CVE-2026-78243— Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Quick assessment
Affected
Apache Software Foundation Apache YuniKorn
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache YuniKorn 1.8.0 及更高版本中，若配置了 LDAP 组解析器（LDAP group resolver），在处理组成员身份信息时若发生越界读取，将导致程序崩溃。当 LDAP 服务器返回用户（在 Pod 中指定）的组成员身份信息（memberOf 属性）时，如果某条成员记录不以 “CN=” 开头，则服务器会发生崩溃。 此问题仅影响那些配置了非默认 LDAP 组提供程序的安装环境。 建议用户升级至 1.10.0 版本，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78243
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Source: CVE Program / CVE List V5
Vulnerability Description
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".
This only affects install that have the non default LDAP group provider configured.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:N/R:A/V:D/RE:H/U:Green
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn | 1.8.0 ~ 1.10.0 | - |
|
II. Public POCs for CVE-2026-78243
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78243
请登录查看更多情报信息。
Other References for CVE-2026-78243 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-07 · 6 CVEs total
| CVE-2026-97146 | 4.8 MEDIUM | Apache YuniKorn: Admission control bypass via system label forgery |
| CVE-2026-92393 | 2.0 LOW | Apache YuniKorn: Admission control bypass via workload UPDATE operation |
| CVE-2026-93684 | Apache Impala: Stored XSS in Impala query plans | |
| CVE-2026-90466 | Apache Impala: Path traversal executes JARs outside trusted paths | |
| CVE-2026-97720 | Apache Impala: Impala Executor Webserver Auth Bypass |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-97146
Apache YuniKorn: Admission control bypass via system label f -
CVE-2026-92393
Apache YuniKorn: Admission control bypass via workload UPDAT -
CVE-2026-93684
Apache Impala: Stored XSS in Impala query plans -
CVE-2026-90466
Apache Impala: Path traversal executes JARs outside trusted -
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass
Same weakness: CWE-248
-
CVE-2026-102413
Uncaught Exception in Elastic Endpoint Leading to Denial of -
CVE-2026-96286
Apache Thrift: Perl servers end `serve()` when serving one c -
CVE-2026-96277
Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non -
CVE-2026-94646
Apache Thrift: Node.js `server.js` ends the process on any p -
CVE-2026-90440
Apache Thrift: An exception escaping a libevent callback sto
V. Comments for CVE-2026-78243
No comments yet