CVE-2026-78243

Executive Summary

Apache YuniKorn releases 1.8.0 and later contain an out-of-bounds read (CWE-248, uncaught exception / uncontrolled crash) in the non-default LDAP group resolver. When an LDAP server returns a memberOf group membership entry for a user referenced in a submitted pod and a membership record does not begin with the literal string CN=, the scheduler reads past the valid bounds of the parsed record and terminates. Only installations explicitly configured with the optional LDAP group provider are affected, and successful exploitation yields denial of service against cluster scheduling rather than data compromise.

Technical Analysis

The defect resides in Apache YuniKorn's LDAP group resolution path. YuniKorn performs group membership lookups for users associated with submitted pods when the LDAP group provider is enabled — a configuration that is explicitly described as non-default. The vulnerable logic processes each memberOf attribute value returned by the LDAP server and assumes the membership record is a Distinguished Name beginning with CN=.

When a returned membership entry does not start with CN=, the parsing routine performs an out-of-bounds read: the code reads bytes beyond the valid extent of the buffer holding the parsed record. The NVD description characterizes the resulting condition as a crash — the scheduler process terminates rather than reading the intended value. CWE-248 (Uncaught Exception) captures the observable failure mode: the out-of-bounds read is not contained, and the resulting error propagates uncaught, killing the component.

Two properties of the flaw shape its exposure:

1. Configuration-gated reachability. The vulnerable code path is only reachable when the LDAP group resolver is active. Default YuniKorn deployments do not use this provider, so the population of exposed systems is materially smaller than "all YuniKorn installs." The NVD description states this limitation explicitly.
2. Data-dependent trigger. Whether the crash fires depends on the shape of the directory data returned by the LDAP server, not on attacker-controlled request syntax. Any membership record lacking the CN= prefix — whether placed there by an attacker with directory write access, or already present as a legacy, malformed, or non-standard DN-formatted entry in a corporate directory — satisfies the trigger condition.

The combination is notable: exploitation does not require the attacker to inject malformed data. An organization's own pre-existing directory content can constitute the trigger, meaning the first pathological record encountered in normal operation can crash the scheduler without any adversarial action. Where an adversary can influence directory content — for example, by controlling a group membership attribute for an account that then submits a pod — the trigger becomes remotely reachable across the scheduler's trust boundary.

No function names, class names, file paths, or specific code constructs beyond the memberOf attribute and the CN= prefix requirement are disclosed in the supplied data; those are the only implementation-level identifiers that can be cited without fabrication.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-78243, and no exploit code or Nuclei template was identified. The attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. An adversary identifies an Apache YuniKorn deployment version 1.8.0 or later — for example, by fingerprinting the scheduler interface or reading published cluster configuration — and determines whether the optional LDAP group resolver is configured. This is the pivotal gate: if the LDAP group provider is not in use, no attack path exists. Configuration may be inferable from scheduling behavior, exposed configuration surfaces, or internal knowledge in an insider scenario.

2. Trigger of the flaw class. The attacker arranges for a user referenced in a submitted pod to have an LDAP memberOf membership entry that does not begin with CN=. Two realistic routes exist, both consistent with the description:

   • Directory write path: an attacker who can create or modify a group or user object in the backing directory introduces a membership record with a non-CN= prefix (for example, a record whose leading attribute is a different naming attribute). YuniKorn's resolver subsequently retrieves that record when resolving groups for the associated user.
   • Environmental path: a non-CN= membership record already exists in the directory from legacy data, federated directory synchronization, or a non-standard schema. In this case the crash occurs on the next ordinary group resolution touching that user, with no attacker action required.

3. Execution mechanism. The attacker submits a pod (or waits for an existing workload to be re-evaluated) whose user maps to the poisoned or malformed membership entry. YuniKorn's LDAP group resolver retrieves the memberOf value. Because the record does not begin with CN=, the parsing routine reads beyond the valid bounds of the record buffer, the condition is not handled, and an uncaught exception propagates, terminating the scheduler process. No payload in the traditional sense is delivered — the malformed directory record itself is the trigger.

4. Post-exploitation impact. The outcome is denial of service against the scheduling layer. With the scheduler down, new pod placements fail and pending workloads are not dispatched, degrading or stalling cluster workload orchestration until the process restarts and re-encounters the triggering record. The flaw provides no read primitive, no write primitive, and no code execution; the out-of-bounds read is a crash vector only. Persistence of the malicious directory entry makes the condition recurring rather than one-shot: each restart that re-resolves the same user re-triggers the crash, producing a restart loop.

Impact Assessment

Confidentiality: None. The out-of-bounds read is followed immediately by process termination; the supplied description discloses no mechanism by which over-read bytes are returned to any caller or written to logs accessible to an attacker.

Integrity: None. No data modification primitive is described.

Availability: High. This is the entire impact of the vulnerability. The scheduler process crashes, halting workload scheduling and placement. In a Kubernetes environment, YuniKorn's scheduling role means new pods and resource-allocated jobs are not placed while the scheduler is unavailable, which can also affect workloads that depend on rescheduling after node failure or eviction.

Privileges Required: Low, in the directory-write scenario. An actor who can write an LDAP group membership record can arm the trigger. In the environmental scenario, no privileges are required at all — the condition pre-exists.

Scope and blast radius. The affected population is limited to YuniKorn 1.8.0+ installations with the non-default LDAP group provider enabled. Within that population, every tenant or workload whose user identity resolves through the LDAP group resolver shares the same single-point-of-failure: one poisoned or malformed record can crash the scheduler for the entire cluster, not merely for the submitting namespace. Multi-tenant clusters where tenants are mapped to LDAP groups therefore have a cross-tenant availability dependency. Because recovery is a process restart, the effective duration of an outage is governed by whether the triggering record is removed before the scheduler re-resolves the affected user — an attacker aiming to maximize impact would leave the record in place to sustain a crash loop.

CVSS note. The data provided supplies no CVSS score or vector; the score is reported as N/A. The vector in the METADATA block is an analytical assessment consistent with the described mechanism and is not a vendor-published value.

Detection Guidance

Sigma Rule

title: Apache YuniKorn LDAP Group Resolver Out-of-Bounds Read Crash
id: 6c1a6b2e-7824-4c43-9f1d-0000007824a3
status: experimental
description: Detects scheduler process termination consistent with CVE-2026-78243, where a non-CN= prefixed LDAP memberOf record triggers an out-of-bounds read and crash in YuniKorn's LDAP group resolver.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78243
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_crash:
    - 'yunikorn'
    - 'scheduler'
  selection_error:
    - 'out of bounds'
    - 'OutOfBounds'
    - 'IndexOutOfBounds'
    - 'uncaught exception'
    - 'memberOf'
    - 'CN='
  selection_exit:
    - 'exited with status'
    - 'signal: killed'
    - 'SIGSEGV'
    - 'panic:'
  condition: selection_crash and selection_error
falsepositives:
  - Scheduled scheduler restarts during maintenance
  - Unrelated LDAP connectivity failures
level: medium
tags:
  - attack.t1499
  - cwe.248

YARA Rule

rule CVE_2026_78243_YuniKorn_LDAP_MemberOf_OOB
{
    meta:
        author = "valtersit.com"
        description = "Detects YuniKorn configs/logs referencing LDAP group resolver and memberOf (CVE-2026-78243)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78243"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $yk1 = "yunikorn" ascii nocase
        $ldap1 = "ldap" ascii nocase
        $grp1 = "group" ascii nocase
        $mo1 = "memberOf" ascii
        $mo2 = "memberof" ascii nocase
        $cn1 = "CN=" ascii

    condition:
        filesize < 5MB and
        $yk1 and
        $ldap1 and
        $grp1 and
        ( $mo1 or $mo2 )
}

Suricata IDS Rule

alert tcp any any -> any 389 (msg:"CVE-2026-78243 Apache YuniKorn LDAP memberOf group resolution - potential OOB read trigger"; flow:to_server,established; content:"memberOf"; nocase; content:"CN="; nocase; distance:0; within:256; classtype:attempted-dos; reference:cve,2026-78243; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78243; sid:202678243; rev:1;)

alert tcp any any -> any 636 (msg:"CVE-2026-78243 Apache YuniKorn LDAP memberOf group resolution over LDAPS - potential OOB read trigger"; flow:to_server,established; content:"memberOf"; nocase; classtype:attempted-dos; reference:cve,2026-78243; sid:202678244; rev:1;)

Elastic Detection

process where event.type == "end" and process.name : ("yunikorn-scheduler", "yunikorn") and
  (process.exit_code != 0 or process.args : "*scheduler*")

dns where dns.question.name : "*" and
  process.name : "yunikorn-scheduler" and
  dns.question.type == "SRV"

Complementary process-crash correlation (multi-event / EQL sequence):

sequence by host.id with maxspan=5m
  [ process where process.name : "yunikorn-scheduler" and process.exit_code != 0 ]
  [ process where process.name : "yunikorn-scheduler" ]

Splunk SPL Query

index=kubernetes OR index=syslog sourcetype IN ("kube:apiserver","linux:syslog","containers")
(sourcetype=*yunikorn* OR "yunikorn")
("memberOf" OR "CN=" OR "out of bounds" OR "uncaught exception" OR "OutOfBounds")
| stats count min(_time) as firstSeen max(_time) as lastSeen by host, source, message
| where count >= 1
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

Restart-loop variant:

index=kubernetes sourcetype="containers" yunikorn
("Exited" OR "BackOff" OR "CrashLoopBackOff")
| stats count values(Reason) by PodName, Namespace
| where count > 2

Wazuh OSSEC Rule

<group name="apache,yunikorn,">
  <rule id="2026783" level="10">
    <decoded_as>json</decoded_as>
    <field name="kubernetes.pod">yunikorn</field>
    <match>memberOf|CN=|out of bounds|uncaught exception|OutOfBounds</match>
    <description>Apache YuniKorn LDAP group resolver OOB read/crash (CVE-2026-78243)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_78243,</group>
  </rule>

  <rule id="2026784" level="12">
    <if_sid>2026783</if_sid>
    <field name="kubernetes.container">yunikorn-scheduler</field>
    <description>Apache YuniKorn scheduler crash, possibly CVE-2026-78243 (LDAP memberOf non-CN= record)</description>
    <group>cve_2026_78243,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). NVD states that "Users are recommended to upgrade to version 1.10.0, which fixes this issue." No vendor advisory identifier, commit hash, or CVE-specific patch artifact was provided in the data supplied. Approval of any upgrade should be validated against the Apache YuniKorn project's own release notes and advisory channel before deployment.

1) Immediate mitigations

• Disable the LDAP group resolver if group-based scheduling policy does not require it. The NVD description states the vulnerability only affects installations with the non-default LDAP group provider configured; reverting to the default configuration removes the attack path entirely. This is the highest-confidence mitigation available while unpatched.
• Audit directory data for non-CN= membership records. Enumerate memberOf values across the directory and identify any entry whose value does not begin with CN=. Even with no adversary present, these records are latent crash triggers under the vulnerable code path.
• Restrict write access to LDAP group membership attributes. The critical precondition for deliberate exploitation is the ability to create or modify a memberOf record. Enforce least privilege on directory objects and monitor changes to group membership for accounts associated with pod submission.
• Constrain pod-submission rights. If the directory is writable by the same accounts that can submit pods, an unprivileged user can self-arm the trigger. Separation of these roles removes the low-privilege path.
• Deploy scheduler health supervision — restart policies and alerting on repeated YuniKorn scheduler exits — so that crash loops are detected quickly even in the absence of a fix.

2) Patch / upgrade steps

• Upgrade Apache YuniKorn to 1.10.0 or later, the version identified as containing the fix.
• Validate the upgrade in a staging cluster configured with the LDAP group provider and a directory containing test membership records, confirming that a non-CN= memberOf value no longer terminates the scheduler.
• Re-enable the LDAP group resolver only after the upgrade is confirmed.
• Track the Apache YuniKorn project release channel for any forthcoming advisory-specific identifier for this CVE, as none was included in the supplied data.

3) Long-term hardening

• Replace manual LDAP group writes with directory synchronization controlled by a trusted pipeline, enforcing schema validation that guarantees memberOf values conform to expected DN syntax. Validation at the source prevents recurrence better than validation at the consumer.
• Treat scheduler components as availability-critical: apply process-level supervision, run redundant scheduler instances where YuniKorn's model permits, and define recovery objectives for scheduling outages.
• Enforce least privilege across directory read and write paths and pod-submission RBAC, so that no single account can both influence directory content and drive the resolution path.
• Add continuous integrity checking of group membership attributes, alerting on anomalous or newly introduced records that deviate from naming conventions.
• Maintain a software inventory keyed to product and version for YuniKorn across all clusters, enabling rapid identification of affected installations as advisories evolve.

References

• NVD — CVE-2026-78243: https://nvd.nist.gov/vuln/detail/CVE-2026-78243
• Apache YuniKorn project site and release notes: https://yunikorn.apache.org/
• Apache Software Foundation security advisories: https://apache.org/security/
• CWE-248 — Uncaught Exception: https://cwe.mitre.org/data/definitions/248.html
• CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-78243 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score published for this CVE as of this report): https://www.first.org/epss/

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-78243. No public proof-of-concept, exploit code, or Nuclei template was available at the time of writing.