volcano.sh vulnerabilities

Products

• volcano.sh/volcano 3

Latest volcano.sh CVEs

Newest publication first

1. CVE-2026-44247 Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size

   Published 2026-05-27

   High·CVSS 7.4 EPSS 0.17%

   Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request b...

2. CVE-2025-32777 Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

   Published 2025-04-30

   High·CVSS 8.2 EPSS 0.48%

   Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a...

3. CVE-2024-36533 Volcano has insecure permissions

   Published 2024-07-24

   Critical·CVSS 9.8 EPSS 0.48%

   Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.