The vulnerability CVE-2026-62391 in Apache Kyuubi is due to improper limitation of a pathname to a restricted directory (CWE-22), combined with an incomplete fix for CVE-2025-66518. Clients able to connect to the Apache Kyuubi Server through frontend protocols can bypass the server-side configuration 'kyuubi.session.local.dir.allowlist' by exploiting unprefixed Spark configuration aliases. This allows unauthorized access or manipulation of restricted directories, potentially compromising sensitive data or server integrity. The affected versions are from 1.6.0 up to but not including 1.12.0. Users are advised to upgrade to version 1.12.0, which addresses this issue.

Successful exploitation allows an attacker with access to the Kyuubi Server frontend protocols to bypass directory allowlist restrictions, potentially leading to unauthorized access or modification of files outside intended directories. This compromises confidentiality and integrity of the system but does not impact availability. The CVSS score of 8.1 reflects a high severity with network attack vector, low attack complexity, and no user interaction required.

Users should upgrade Apache Kyuubi to version 1.12.0, which contains the fix for this vulnerability. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in the provided data, but the vendor recommends upgrading to 1.12.0 to resolve the issue.