Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Apache YuniKorn crashes when LDAP group names are not capitalized

CVE-2026-78243 · published 11 days ago
Summary

If YuniKorn is set up to read group information from an LDAP directory and the directory returns a group name that does not start with "CN=", the service stops working. This only happens in installations that use the optional LDAP group provider. Upgrade YuniKorn to version 1.10.0 to prevent the crash.

What to do
  • Update apache software foundation apache yunikorn to version 1.10.0 or later.
Affected software
VendorProductAffected versions
apache software foundation apache yunikorn < 1.10.0
Original advisory text
Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".




This only affects install that have the non default LDAP group provider configured. 


Users are recommended to upgrade to version 1.10.0, which fixes this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-248Uncaught Exception
Timeline
Published7 Oct 2026
Updated15 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-78243 · NVD
CVE-2026-78243 · MITRE
Track software like this
Free during beta