PT-2026-66744 · Apache · Apache Kyuubi

Anand Nalya · CVE-2026-62391 · Publicado 2026-07-31 · Atualizado 2026-07-31

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases.

This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

CWE-27

Identificadores relacionados

CVE-2026-62391

Produtos afetados

Apache Kyuubi

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-62391 · Nota de Segurança
• https://lists.apache.org/thread/vo4k4nxz23kfzrpp120nsojb0vrkx4w1 · Aviso do Fabricante