CVE-2026-62391

creationtimestamp| type| source ---|---|--- 2026-07-31 11:36:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/65sh4aa55lke2 2026-09-02 12:05:14+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mujvgkhxfs2j...

CVE-2026-62391

Apache Kyuubi versions 1.6.0 before 1.12.0 are vulnerable to Directory Traversal due to incomplete fixes for CVE-2025-66518. An attacker can bypass the kyuubi.session.local.dir.allowlist configuration by submitting Spark frontend requests that use unprefixed Spark config aliases (such as files) i...