A critical security vulnerability (CVE-2026-33186) affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. Versions prior to 1.8.0-r4 are vulnerable. The flaw has a high impact on confidentiality and integrity but does not affect availability. A patch is available in version 1.8.0-r4.