Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Apache Gravitino 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage. id: CVE-2026-41042 info: name: Apache Gravitino 1.2.1 -...

cve-2026-41042

CVE-2026-41042: Apache Gravitino --metalake NAME --cmd CMD --port PORT オプション| デフォルト| 説明 ---|---|--- target| （必須）| Gravitino サーバー（例：http://127.0.0.1:8090） --metala...

URL Path Injection

Apache Gravitino is vulnerable to URL Path Injection. The vulnerability is due to unencoded user-supplied identifiers being used in URL paths, allowing an attacker to inject path components into requests...

Server-Side Request Forgery

Apache Gravitino is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of job template URIs in JobManager, allowing authenticated attackers to force the server to send HTTP requests to arbitrary internal network services or cloud metadata endpoints...

Apache Gravitino 1.2.1 - SSRF

Exploit Title: Apache Gravitino 1.2.1 - SSRF Google Dork: N/A Date: 2026-07-13 Exploit Author: Ajay Rajpurohit Vendor Homepage: https://gravitino.apache.org/ Software Link: https://github.com/apache/gravitino Version: 1.0.0 - 1.2.1 Tested on: Ubuntu 22.04 LTS CVE: CVE-2026-49876 Description: A...

Apache Gravitino 1.2.1 Server-Side Request Forgery

A server-side request forgery vulnerability exists in Apache Gravitino versions 1.0.0 through 1.2.1 via the fetchFileFromUri method in JobManager.java. Exploit Title: Apache Gravitino 1.2.1 - SSRF Google Dork: N/A Date: 2026-07-13 Exploit Author: Ajay Rajpurohit Vendor Homepage:...

PYSEC-2026-3441

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

PYSEC-2026-3441

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041

Apache Gravitino versions from 1.0.0 before 1.2.1 are vulnerable to a URL path injection vulnerability (CWE-177 ). The root cause is the improper handling of URL encoding (specifically hex encoding) during f-string URL construction within the MCP REST client component. This allows an attacker to ...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

EUVD-2026-43324

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-49876 Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to...

CVE-2026-41041: Improper Handling of URL Encoding (Hex Encoding)

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-49876: Server-Side Request Forgery (SSRF)

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to...

PT-2026-57679

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41042: Improper Input Validation

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2025-53648

The Apache Gravitino UI is vulnerable to SQL Injection due to improper handling of SQL statements in versions 1.0.0 and below . A malicious user can exploit this misconfiguration to read or truncate files or gain unauthorized access to and modify files. Remediation requires upgrading the org.apac...