CVE-2026-44247: Volcano Webhook Server DoS Vulnerability

CVE-2026-44247 Overview

CVE-2026-44247 affects Volcano, a Kubernetes-native batch scheduling system. The Volcano webhook server fails to enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint can send an arbitrarily large request body. The oversized payload exhausts available memory and causes the webhook server process to be terminated by the Linux out-of-memory (OOM) killer. All Volcano deployments exposing the webhook server to in-cluster traffic are affected. The issue is fixed in versions v1.14.2, v1.13.3, and v1.12.4. The weakness is classified under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
An authenticated in-cluster pod can crash the Volcano webhook server through memory exhaustion, disrupting batch scheduling operations across the Kubernetes cluster.

Affected Products

Volcano versions prior to v1.14.2
Volcano versions prior to v1.13.3
Volcano versions prior to v1.12.4

Discovery Timeline

2026-05-27 - CVE-2026-44247 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44247

Vulnerability Analysis

The Volcano webhook server validates and mutates Kubernetes resources such as Job, PodGroup, and Queue objects. The webhook accepts HTTP POST requests from the Kubernetes API server and other in-cluster clients. The server reads the entire request body into memory before processing it.

The vulnerability stems from the absence of a maximum request body size limit on the webhook handler. An attacker with network reachability to the webhook endpoint can submit a single request with a multi-gigabyte payload. The Go HTTP handler buffers the body in memory during decoding. Memory consumption grows proportionally to the payload size and triggers the kernel OOM killer, terminating the webhook pod.

When the webhook server is unavailable, admission requests for Volcano-managed resources fail. This disrupts batch job submission and scheduling across the cluster.

Root Cause

The webhook HTTP handler does not wrap r.Body with http.MaxBytesReader or apply equivalent size validation before deserialization. Without an upper bound, the resource consumption scales with attacker input, satisfying the conditions for CWE-400.

Attack Vector

The attack requires network access from inside the cluster to the webhook service endpoint. Any pod with default network policies can reach the webhook, including pods running with low-privilege service accounts. The attacker sends an HTTP request with a deliberately large body to the webhook admission endpoint. Repeated requests sustain the denial of service condition across webhook pod restarts.

Refer to the GitHub Security Advisory GHSA-8wxp-xxp2-rcgx for additional technical context.

Detection Methods for CVE-2026-44247

Indicators of Compromise

Repeated OOMKilled termination events on Volcano webhook pods in the volcano-system namespace.
Sudden spikes in memory usage on webhook pods immediately preceding pod restarts.
Kubernetes admission webhook failures referencing Volcano endpoints (validate-pod.volcano.sh, mutate-pod.volcano.sh).
HTTP requests to webhook service ports with abnormally large Content-Length headers from in-cluster pod IPs.

Detection Strategies

Monitor pod restart counts and lastState.terminated.reason fields for webhook deployments using kubectl get pods -n volcano-system -o json.
Inspect kube-apiserver audit logs for admission webhook timeouts and failed calls to Volcano webhook services.
Correlate node-level kernel logs containing Out of memory: Killed process entries with Volcano webhook container identifiers.

Monitoring Recommendations

Configure Prometheus alerts on container_memory_working_set_bytes for the Volcano webhook deployment with thresholds tied to the configured memory limit.
Track the apiserver_admission_webhook_request_total metric filtered by Volcano webhook names for elevated error rates.
Enable NetworkPolicy logging or service mesh telemetry to identify pods initiating large requests to webhook service ports.

How to Mitigate CVE-2026-44247

Immediate Actions Required

Upgrade Volcano to v1.14.2, v1.13.3, or v1.12.4 depending on the deployed minor version.
Apply a Kubernetes NetworkPolicy restricting ingress to the Volcano webhook service to the kube-apiserver source range only.
Set explicit memory limits on the webhook deployment so OOM events are contained and observable.
Audit cluster pods for unexpected workloads that could reach the webhook endpoint.

Patch Information

The maintainers released fixes in Volcano v1.14.2, v1.13.3, and v1.12.4. The patches enforce a maximum size on incoming HTTP request bodies in the webhook server. Cluster operators should pull the updated container images and roll the volcano-admission deployment. Refer to the Volcano Security Advisory GHSA-8wxp-xxp2-rcgx for release artifacts.

Workarounds

Place an ingress proxy or service mesh sidecar in front of the webhook with a request body size limit (for example, an Envoy max_request_bytes filter).
Restrict webhook reachability with a strict NetworkPolicy allowing only the API server CIDR on the webhook port.
Configure horizontal pod autoscaling and pod disruption budgets to maintain webhook availability during partial outages until patches are applied.

bash

# Restrict webhook ingress to kube-apiserver only
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: volcano-webhook-restrict
  namespace: volcano-system
spec:
  podSelector:
    matchLabels:
      app: volcano-admission
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/24  # Replace with kube-apiserver source range
      ports:
        - protocol: TCP
          port: 8443
EOF

# Upgrade Volcano to a patched release
helm upgrade volcano volcano/volcano --version 1.14.2 -n volcano-system