CVE-2026-62391 - Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

Back Back to CVE browser

HIGH

Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

Published Jul 31, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.79%

Description

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases.

This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache Kyuubi Default
unaffected
- Version
  1.6.0
  Status
  affected
  Constraints
  <1.12.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Kyuubi

unaffected

Version	Status	Constraints
1.6.0	affected	<1.12.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-22

Path Traversal

CWE-27

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51518
Advisory
https://lists.apache.org/thread/vo4k4nxz23kfzrpp120nsojb0vrkx4w1
vendor-advisoryMailing ListVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51518		Advisory
https://lists.apache.org/thread/vo4k4nxz23kfzrpp120nsojb0vrkx4w1		vendor-advisoryMailing ListVendor Advisory