[<prev] [next>] [day] [month] [year] [list]
Message-ID: <75da3a58-ba87-1aca-894e-ac8f822fbdf5@apache.org>
Date: Fri, 31 Jul 2026 09:19:29 +0000
From: Akira Ajisaka <aajisaka@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-62391: Apache Kyuubi: kyuubi.session.local.dir.allow.list
bypass via unprefixed Spark file-conf aliases
Severity: important
Affected versions:
- Apache Kyuubi (org.apache.kyuubi:kyuubi-server) 1.6.0 before 1.12.0
Description:
The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases.
This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0.
Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Credit:
Anand Nalya (finder)
References:
https://kyuubi.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-62391
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
