CVE-2026-23904highCWE-923

CVE-2026-23904: high-severity vulnerability in Apache Kyuubi

Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy

Published

Follow this CVE+ Monitor Apache Kyuubi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.9%
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Apache Software Foundation · Apache Kyuubi
Related CVEs — Apache Kyuubi

In the same product, most dangerous first.

CVE-2026-52680CRITICALApache Kyuubi: REST batch multipart upload path traversal allows controlled file writeEPSS 1.1%CVE-2025-66518HIGHApache Kyuubi: Unauthorized directory access due to missing path normalizationEPSS 1.0%CVE-2026-62391HIGHApache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliasesEPSS 0.8%