CVE-2026-92393— Apache YuniKorn: Admission control bypass via workload UPDATE operation
Quick assessment
Affected
Apache Software Foundation Apache YuniKorn
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache YuniKorn 1.9.0 及更早版本未对工作负载的 UPDATE 操作实施标签和用户注解检查，从而绕过了所有安全检查。在 YuniKorn 中，工作负载定义如下 Kubernetes 对象：“deployments”（部署）、“replicasets”（副本集）、“statefulsets”（有状态集）、“daemonsets”（守护进程集）、“jobs”（作业）和“cronjobs”（定时作业）。对于 CREATE 操作，所有对象类型均正确执行了检查。 该漏洞使得任何用户均可指定任意的用户信息注
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92393
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache YuniKorn: Admission control bypass via workload UPDATE operation
Source: CVE Program / CVE List V5
Vulnerability Description
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types.
The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn | 0 ~ 1.10.0 | - |
|
II. Public POCs for CVE-2026-92393
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92393
请登录查看更多情报信息。
Other References for CVE-2026-92393 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-07 · 6 CVEs total
| CVE-2026-97146 | 4.8 MEDIUM | Apache YuniKorn: Admission control bypass via system label forgery |
| CVE-2026-78243 | 2.1 LOW | Apache YuniKorn: LDAP Group provider panics on lowercase attribute name |
| CVE-2026-93684 | Apache Impala: Stored XSS in Impala query plans | |
| CVE-2026-90466 | Apache Impala: Path traversal executes JARs outside trusted paths | |
| CVE-2026-97720 | Apache Impala: Impala Executor Webserver Auth Bypass |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-97146
Apache YuniKorn: Admission control bypass via system label f -
CVE-2026-78243
Apache YuniKorn: LDAP Group provider panics on lowercase att -
CVE-2026-93684
Apache Impala: Stored XSS in Impala query plans -
CVE-2026-90466
Apache Impala: Path traversal executes JARs outside trusted -
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass
V. Comments for CVE-2026-92393
No comments yet