Authorization Bypass Vulnerability in Apache YuniKorn Affects Multiple Versions
CVE-2026-97146

4.8MEDIUM

Key Information:

Vendor

Apache
Status
Apache Yunikorn
Vendor
CVE Published:
7 October 2026

What is CVE-2026-97146?

A security vulnerability in Apache YuniKorn versions 1.9.0 and earlier permits the bypass of user annotation checks through the assignment of a secondary label to the pod. If the pod is labeled with 'app=yunikorn', the system fails to perform necessary checks on user annotation content. This vulnerability can lead to unauthorized access to queues, potentially allowing users to access resources they should not typically interact with, thereby impacting overall quota usage and possibly violating user-specific resource limits. Users should upgrade to version 1.10.0 to mitigate this risk.

Affected Version(s)

Apache YuniKorn 0 < 1.10.0

References

https://lists.apache.org/thread.html/nds5ct9xzlo4fp0jfr1r...
vendor-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mopmonk-ai@tophant.com
.