CVE-2026-91925: Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine
Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Polyaxon user who can submit a run can exploit it by placing a Jinja2 payload in an affected operation specification field.
Which operation specification fields are affected?
The affected fields identified are queue, namespace, conditions, presets, and dependencies.
What level of access could successful exploitation provide?
Payloads can execute operating system commands in the scheduler process context. This can expose database credentials and service tokens, with high impact to confidentiality, integrity, and availability.
Are deployments running a default configuration affected?
The provided information identifies rendering through an unsandboxed Jinja2 environment during server-side run preparation, but does not state whether this behavior requires a non-default configuration.