CVE-2026-41041

CriticalCVSS 9.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

A URL path injection vulnerability via unencoded user-supplied identifiers has been found in Apache Gravitino. The issue affects versions from 1.0.0 before 1.2.1.

Risk Assessment

An attacker could manipulate URL paths, potentially gaining access to unauthorized resources or performing unintended operations on the server.

Recommendation

Upgrade Apache Gravitino to version 1.2.1 immediately, which includes a fix for this vulnerability.

Other vulnerabilities in Apache Gravitino

See all

CVE-2026-41042Critical
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino before version 1.2.1.
CVE-2026-49876Medium
Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. This vulnerability affects Apache Gravitino from version 1.0.0 through 1.2.1.

Original NVD description (English source)

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.