CVE-2026-92287: CWE-20 Improper input validation in Apache Software Foundation Apache Arrow C++

This vulnerability arises from the pass-through of unvalidated Key Management Service (KMS) URLs to KMS clients in Apache Arrow C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. When reading Parquet files with decryption configured, the KMS URL can be controlled either by the application or by the file. If the application does not specify the KMS URL, a potentially malicious file-controlled URL is forwarded to the KmsClient. If the KmsClient does not validate the host of the KMS URL, it may send sensitive KMS tokens to an attacker-controlled host. The issue is addressed in version 26.0.0 by disabling file-controlled KMS URLs by default and requiring users to explicitly enable this feature with the read_kms_url flag, alongside ensuring KmsClient implementations validate URLs.

If exploited, this vulnerability could lead to sensitive KMS tokens being sent to attacker-controlled hosts, potentially compromising the confidentiality of encrypted data. The impact depends on whether the KmsClient implementation validates the KMS URL and whether the KMS URL is controlled by an attacker via the file. No known exploits are reported in the wild at this time.

Users should upgrade to Apache Arrow C++ version 26.0.0 or later, which disables file-controlled KMS URLs by default and requires explicit opt-in to enable this behavior. For users who cannot upgrade immediately, it is recommended to specify the KMS URL explicitly in the KmsConnectionConfig when reading Parquet files or ensure that any KmsClient implementations perform strict validation of KMS URLs to prevent sending tokens to malicious hosts. Users opting in to file-controlled KMS URLs in version 26.0.0 and later must ensure KmsClients validate URLs properly.