This vulnerability affects Apache Parquet Hadoop versions 1.12 to 1.18 in the org.apache.parquet.crypto.keytools package, which supports envelope encryption using a Key Management Service (KMS). The KMS URL parameter can be controlled either by the application or by the file. When file-controlled, the URL is forwarded to a pluggable KmsClient implementation without guaranteed host validation. If the KmsClient does not validate the host, an attacker can specify a malicious host in the file, causing sensitive KMS tokens to be sent to an unauthorized party. The vulnerability stems from improper input validation (CWE-20). The vendor recommends users leverage application control of the KMS URL parameter as a mitigation until the issue is fixed. The anticipated fix in version 1.19 will disable file-controlled KMS URLs by default and require explicit validation and authentication if this feature is enabled.

If exploited, this vulnerability could lead to the exposure of sensitive KMS tokens to an attacker-controlled host, potentially compromising the confidentiality of encrypted Parquet files. The impact depends on whether the KmsClient implementation performs host validation and whether the KMS URL is file-controlled. No known exploits are reported in the wild at this time.

Users should enforce application control over the KMS URL parameter in readers for affected versions 1.12 through 1.18 to prevent malicious hosts from receiving KMS tokens. After upgrading to version 1.19 or later, file-controlled KMS URLs will be disabled by default. If file-controlled KMS URLs are enabled via a new application parameter, users must ensure that their KmsClient implementation performs strict host validation and uses authentication as documented. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.