Apache YuniKorn CVE-2026-78243

Exploitation requires that the instance be configured with the non-default LDAP group resolver (the group membership / memberOf resolution feature) - default installations are not affected. The crash is triggered specifically when the LDAP server returns a memberOf group-membership entry for a user named in a submitted pod where that entry does not start with the 'CN=' prefix. Limiting factors: the vulnerable code path only runs for the optional LDAP provider, the attacker must cause a pod referencing an affected user to be processed, and triggering it requires a malformed/non-CN LDAP record that is typically governed by directory contents rather than attacker-controlled input, which is why the vendor rates it AC:H/AT:P. Impact is confined to availability (scheduler crash); no data exposure or modification occurs.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The only authoritative scoring provided is a CVSS 4.0 base of 2.1 (low), with vulnerable-system impact limited to availability (VC:N/VI:N/VA:L) - i.e. a denial-of-service crash of the YuniKorn scheduler, with no confidentiality or integrity impact. The vector's AC:H and AT:P correctly reflect that exploitation is not straightforward: it depends on a non-default LDAP group resolver being configured AND the LDAP directory returning a malformed memberOf entry (one not starting with 'CN='). No EPSS score, no KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore an operational robustness/availability bug that is far more likely to be triggered accidentally by real-world LDAP data than deliberately weaponized. Note the input provides a CVSS 4.0 vector but no CVSS 3.1 vector, so cross-version comparison relies on an independent assessment.

In a cluster where YuniKorn is configured with the optional LDAP group resolver, a user referenced in a submitted pod has an LDAP memberOf group-membership entry that does not begin with 'CN=' (for example a DN using a lowercase or different attribute prefix). When YuniKorn resolves that user's groups, an out-of-bounds read occurs and the scheduler process crashes, denying scheduling to the whole cluster. No public exploit code is identified at time of analysis, and the condition is as likely to arise from ordinary directory data as from a deliberate attacker.