CVE-2026-62391

creationtimestamp| type| source ---|---|--- 2026-07-31 11:36:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/65sh4aa55lke2 2026-09-02 12:05:14+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mujvgkhxfs2j...

CVE-2026-62391

CVE-2026-62391 affects Apache Kyuubi prior to 1.12.0. The issue allows bypass of the server-side config kyuubi.session.local.dir.allowlist by using unprefixed Spark config aliases, enabling clients that can reach the Kyuubi Server via Kyuubi frontend protocols to bypass the allowlist. Root cause:...