All packages
Apache Gravitino vulnerabilities
3 known CVE vulnerabilities in Apache Gravitino, translated and rated.
- CVE-2026-41041Critical
A URL path injection vulnerability via unencoded user-supplied identifiers has been found in Apache Gravitino. The issue affects versions from 1.0.0 before 1.2.1.
- CVE-2026-41042Critical
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino before version 1.2.1.
- CVE-2026-49876Medium
Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. This vulnerability affects Apache Gravitino from version 1.0.0 through 1.2.1.