CVE-2026-41041criticalCWE-177

CVE-2026-41041: fallo crítico en Apache Gravitino

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

Publicada el

Seguir esta CVE+ Monitorear Apache Gravitino+ Monitorear apache-gravitino

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.6%
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Apache Software Foundation · Apache Gravitino
CVEs relacionadas — Apache Gravitino

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-41042CRITICALApache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameterEPSS 1.5%CVE-2025-53648MEDIUMApache Gravitino: SQL misconfiguration can access or truncate filesEPSS 0.6%CVE-2026-49876MEDIUMApache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIsEPSS 0.5%