Is CVE-2026-44247 actively exploited?

No active exploitation of CVE-2026-44247 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44247 be exploited remotely?

Partially. CVE-2026-44247 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-44247?

CVE-2026-44247 has a CVSS score of 7.4 (HIGH).

HOME VULNERABILITIESCVE-2026-44247

HIGH

CVE-2026-44247

CWE-400Published: May 27, 2026· Updated: Jun 2, 2026

7.4

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.9th

Official Description

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.

NVD Source

Technical Analysis

CVE-2026-44247 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.4.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.