Apache Gravitino
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_gravitino:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Gravitino (76c0eba9-465a-5c57-9056-37453d170ea1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49876 |
vulnerable | 2026-07-29 00:57:45.740049 |
Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs
Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: from 1.0.0 through 1.2.1.
Users are recommended to upgrade to version 1.3.0, which fixes the issue.
Published: 2026-07-13T08:45:35.082Z
Updated: 2026-07-13T14:27:15.256Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41042 |
vulnerable | 2026-07-29 00:49:30.879370 |
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: before 1.2.1.
Users are recommended to upgrade to version 1.2.1, which fixes the issue.
This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.
Published: 2026-07-08T11:38:55.311Z
Updated: 2026-07-08T17:31:28.887Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41041 |
vulnerable | 2026-07-29 00:49:30.878989 |
Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.
Users are recommended to upgrade to version 1.2.1, which fixes the issue.
Published: 2026-07-13T09:08:51.055Z
Updated: 2026-07-13T17:04:02.546Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53648 |
vulnerable | 2026-07-29 00:01:28.837682 |
Apache Gravitino: SQL misconfiguration can access or truncate files
SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.
Users are recommended to upgrade to version 1.0.0, which fixes this issue.
Published: 2026-06-30T13:36:00.654Z
Updated: 2026-06-30T17:35:41.726Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.