Apache Software Foundation Apache Yunikorn vulnerabilities

3 CVEs affecting Apache Software Foundation Apache Yunikorn, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97146, published 2026-10-07.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-97146, published 2026-10-07. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user…
• CVE-2026-92393, published 2026-10-07. Low severity, CVSS 2.0. EPSS: 0.3% chance of exploitation in the next 30 days. Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes…
• CVE-2026-78243, published 2026-10-07. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership…