HIGH🇵🇱 Wersja polska

CVE-2026-23904

CVSS 7.3v3.1pub. 2026-07-29upd. 2026-08-05

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

  • Apache Kyuubi

    APP
    Apache
    1.8.0 – 1.12.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRF
CWE
References

Related vulnerabilities

CVE-2026-52680CRITICAL9.8PL ✓same product

Apache Kyuubi — path traversal w obsłudze multipart upload (REST API)

CVE-2026-62391HIGH8.1PL ✓same product

Apache Kyuubi: niekompletna poprawka path traversal (bypass allowlist)

CVE-2025-66518HIGH8.8same product

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config ...

CVE-2025-24813CRITICAL9.8⚠ KEVPL ✓same vendor

Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych

CVE-2024-38856CRITICAL9.8⚠ KEVPL ✓same vendor

Apache OFBiz — nieautoryzowane wykonanie kodu przez błędną autoryzację