The Kyuubi Engine UI proxy accepts a host and port from the request path and forwards HTTP requests to that destination. This improper restriction of communication channels (CWE-923) enables remote attackers with network access to the proxy to induce the Kyuubi server to send HTTP requests to arbitrary reachable hosts, effectively enabling SSRF or open-proxy functionality. The vulnerability affects Apache Kyuubi versions 1.8.0 through 1.11.x. Version 1.12.0 mitigates the issue by disabling the proxy by default and requiring configuration of allowed target hosts to restore proxy functionality securely.

An attacker with network access to the Kyuubi Engine UI proxy can cause the server to send HTTP requests to arbitrary hosts reachable from the server. This can be used to perform SSRF attacks or abuse the server as an open proxy, potentially leading to unauthorized internal network scanning or access to internal services.

Users should upgrade to Apache Kyuubi version 1.12.0 or later, where the Engine UI proxy is disabled by default. If proxy functionality is required, it must be explicitly enabled by setting 'kyuubi.frontend.rest.engine.ui.proxy.enabled=true' and restricting allowed target hosts via 'kyuubi.frontend.rest.engine.ui.proxy.hosts'. No other official fixes or patches are documented. Patch status is not yet confirmed beyond this upgrade recommendation; users should consult the vendor advisory for the latest remediation guidance.