CVE-2026-41042 is an improper input validation vulnerability (CWE-20) in Apache Gravitino versions prior to 1.2.1. The vulnerability allows unauthenticated callers to provide a crafted H2 JDBC URL through the testConnection API. This URL leverages the H2 database's INIT parameter to execute arbitrary Java code on the server. The flaw is specific to configurations using H2, which is mainly used for testing and local development environments. The vendor recommends upgrading to Apache Gravitino 1.2.1, which addresses this issue.

Successful exploitation results in arbitrary Java code execution on the server hosting Apache Gravitino, potentially compromising the system. However, the impact is limited by the typical use of H2 only in testing or local development and the usual deployment of Gravitino in internal environments. No known exploits are reported in the wild.

Upgrade Apache Gravitino to version 1.2.1 or later, which fixes this vulnerability. Since this is the official fix, no additional mitigations are required. Patch status is confirmed by vendor advisory information embedded in the description.