Threats affecting pkg:maven/Apache Software Foundation/org.apache.kyuubi:kyuubi-server

CVE-2026-62391 is a path traversal vulnerability in Apache Kyuubi affecting versions from 1.6.0 up to but not including 1.12.0. The issue arises because the security fix for a previous vulnerability (CVE-2025-66518) is incomplete, allowing clients with access to the Kyuubi Server via frontend protocols to bypass server-side directory allowlist restrictions using unprefixed Spark config aliases. This vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity without affecting availability.

Apache Kyuubi versions from 1.8.0 before 1.12.0 contain a vulnerability in the Engine UI proxy component that allows remote attackers with network access to cause the server to send HTTP requests to arbitrary hosts. This behavior can lead to Server-Side Request Forgery (SSRF) or open-proxy issues. The vulnerability is addressed in version 1.12.0, which disables the proxy by default and requires explicit configuration to enable it safely.

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.