CVE-2026-91925: Polyaxon Jinja2 Template RCE Vulnerability

CVE-2026-91925 Overview

Polyaxon through version 2.16.4 contains a server-side template injection vulnerability in its operation specification handling. The platform renders operation fields with an unsandboxed Jinja2 environment during server-side run preparation. Authenticated users can submit runs containing Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields. These payloads execute arbitrary operating system commands in the scheduler process context. The flaw is classified under [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].

Critical Impact
Authenticated attackers can execute arbitrary commands on the Polyaxon scheduler, exposing database credentials, service tokens, and downstream infrastructure.

Affected Products

Polyaxon versions up to and including 2.16.4
Polyaxon CLI operation specification parser (cli/polyaxon/_polyaxonfile/specs/libs/engine.py)
Polyaxon scheduler component processing run submissions

Discovery Timeline

2026-09-15 - CVE CVE-2026-91925 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91925

Vulnerability Analysis

Polyaxon is a platform for building and managing machine learning workloads at scale. The vulnerability resides in the operation specification pipeline invoked during run preparation. The engine loads user-supplied specification fields into a Jinja2 template environment without enabling the sandboxed environment provided by Jinja2. Because the environment is not restricted, attribute traversal payloads can reach Python built-ins from within any templated field. The scheduler evaluates these templates before dispatching workloads, giving the payload access to the scheduler process context. Impacted fields include queue selection, namespace assignment, run conditions, presets, and dependency declarations.

Successful exploitation yields code execution as the scheduler user. Attackers can read configuration files, database connection strings, Kubernetes service account tokens, and cloud provider credentials mounted into the process. From that position, they can pivot to managed clusters, artifact stores, and adjacent services.

Root Cause

The root cause is the use of a permissive Jinja2 environment where user-controlled strings are rendered as templates. The specification parser trusts run submission fields that should be treated as inert configuration values. Without a SandboxedEnvironment or explicit input validation, standard Jinja2 attribute chains such as __class__.__mro__ and __subclasses__() can reach os.popen or subprocess primitives.

Attack Vector

The attack requires low-privileged authenticated access to the Polyaxon API. An attacker submits a run manifest that embeds a Jinja2 expression inside one of the templated fields. Once the scheduler prepares the run, the template engine evaluates the expression on the server side. No user interaction is required beyond the initial run submission.

See the VulnCheck Polyaxon Advisory and the GitHub Polyaxon Engine Script for the affected code path. No public proof-of-concept code is referenced in the advisory data.

Detection Methods for CVE-2026-91925

Indicators of Compromise

Run submissions containing Jinja2 delimiters such as {{, }}, or {% inside the queue, namespace, conditions, presets, or dependencies fields.
Scheduler process spawning unexpected child processes such as sh, bash, curl, wget, python, or nc.
Outbound network connections from the Polyaxon scheduler to unknown external hosts shortly after a run submission.
Access to sensitive files such as /var/run/secrets/kubernetes.io/serviceaccount/token or environment dumps by the scheduler process.

Detection Strategies

Inspect Polyaxon API request bodies for Jinja2 syntax within specification fields that are not intended to accept templates.
Correlate scheduler process lineage with recent run submissions to identify command execution that follows API activity.
Alert on process execution chains where the Polyaxon scheduler forks shell interpreters or scripting runtimes outside normal job dispatch paths.

Monitoring Recommendations

Enable audit logging on the Polyaxon API for all run submission endpoints and retain payloads for review.
Monitor scheduler container and host telemetry for anomalous process creation, credential file access, and unexpected egress traffic.
Track authenticated user activity for repeated failed or unusual run submissions that may indicate payload iteration.

How to Mitigate CVE-2026-91925

Immediate Actions Required

Restrict Polyaxon API access to trusted networks and enforce least-privilege roles for users permitted to submit runs.
Review recent run submissions for Jinja2 syntax in the affected fields and investigate any matches as suspected exploitation.
Rotate database credentials, service tokens, and cloud provider secrets accessible to the scheduler process if compromise is suspected.
Isolate the scheduler workload from sensitive credential stores until a fixed version is deployed.

Patch Information

At the time of publication, the NVD entry does not list a fixed release. Track the GitHub Polyaxon Repository and the related GitHub Polyaxon Issue #1540 for remediation status. Apply any vendor-supplied patch that replaces the unsandboxed Jinja2 environment with a SandboxedEnvironment or removes template rendering from the affected fields.

Workarounds

Disable or gate run submission for untrusted users through network policy and authentication controls until a patched release is available.
Deploy an API gateway or reverse proxy rule that rejects run submissions containing Jinja2 delimiters in fields that should not accept templates.
Run the Polyaxon scheduler under a dedicated service account with minimal filesystem access and no ambient cloud credentials.
Segment the scheduler network path to prevent outbound connections to arbitrary destinations.

bash

# Example reverse-proxy rule concept: reject Jinja2 delimiters in run submissions
# Adapt the pattern and endpoint to your ingress controller
location /api/v1/runs {
    if ($request_body ~* "(\{\{|\}\}|\{%|%\})") {
        return 400;
    }
    proxy_pass http://polyaxon-api;
}