CVE-2026-97146— Apache YuniKorn: Admission control bypass via system label forgery
Quick assessment
Affected
Apache Software Foundation Apache YuniKorn
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache YuniKorn 1.9.0 及更早版本允许通过设置 Pod 上的二级标签（secondary label）绕过对用户注解（user annotation）的检查。如果 Pod 具有标签 ，则不会执行限制用户注解内容的检查。该标签用于在部署中识别 YuniKorn 应用程序本身。 该绕过漏洞允许任何用户指定任意的用户信息注解。这些任意的用户信息可能导致用户访问其原本无权访问的队列（queue）。如果应用程序在错误的队列中运行，可能会影响该队列的配额使用情况。此外，基于用户的配额 enforcement
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97146
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache YuniKorn: Admission control bypass via system label forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.
The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn | 0 ~ 1.10.0 | - |
|
II. Public POCs for CVE-2026-97146
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97146
请登录查看更多情报信息。
Other References for CVE-2026-97146 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-07 · 6 CVEs total
| CVE-2026-78243 | 2.1 LOW | Apache YuniKorn: LDAP Group provider panics on lowercase attribute name |
| CVE-2026-92393 | 2.0 LOW | Apache YuniKorn: Admission control bypass via workload UPDATE operation |
| CVE-2026-93684 | Apache Impala: Stored XSS in Impala query plans | |
| CVE-2026-90466 | Apache Impala: Path traversal executes JARs outside trusted paths | |
| CVE-2026-97720 | Apache Impala: Impala Executor Webserver Auth Bypass |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-78243
Apache YuniKorn: LDAP Group provider panics on lowercase att -
CVE-2026-92393
Apache YuniKorn: Admission control bypass via workload UPDAT -
CVE-2026-93684
Apache Impala: Stored XSS in Impala query plans -
CVE-2026-90466
Apache Impala: Path traversal executes JARs outside trusted -
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass
V. Comments for CVE-2026-97146
No comments yet