oss-security - CVE-2026-41041: Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <d9afdb5b-f3a2-4e93-4c27-3257e9c1a632@apache.org>
Date: Mon, 13 Jul 2026 02:08:15 +0000
From: Jerry Shao <jshao@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-41041: Apache Gravitino: URL path injection via unencoded
 user-supplied identifiers in MCP REST client f-string URL construction,
 enabling path traversal to unintended API endpoints. 

Severity: low 

Affected versions:

- Apache Gravitino 1.0.0 before 1.2.1

Description:

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

References:

https://gravitino.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-41041

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.