Apache Kyuubi
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_kyuubi:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Kyuubi (f0d8dea5-ccc1-547e-bf24-cb9f674a038f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-52680 |
vulnerable | 2026-09-16 04:33:53.473001 |
Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions.
This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1.
Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Published: 2026-07-30T16:07:12.786Z
Updated: 2026-07-31T17:56:51.075Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23904 |
vulnerable | 2026-09-16 04:33:49.235187 |
Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.
This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.
Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.
Published: 2026-07-29T09:07:18.168Z
Updated: 2026-07-29T14:00:38.959Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-62391 |
vulnerable | 2026-09-16 04:32:53.159692 |
Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases
The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases.
This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0.
Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Published: 2026-07-31T09:58:15.033Z
Updated: 2026-07-31T16:29:28.224Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66518 |
vulnerable | 2026-06-08 07:41:19.109539 |
Apache Kyuubi: Unauthorized directory access due to missing path normalization
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.
This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.
Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
Published: 2026-01-05T08:46:27.649Z
Updated: 2026-01-05T20:27:07.472Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.