CVE-2026-62391

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-62391 Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-62391

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

EUVD-2026-51518

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

org.apache.kyuubi:kyuubi-assembly_2.12 (>=1.6.0-incubating, <=1.11.1), org.apache.kyuubi:kyuubi-codecov_2.12 (>=1.6.0-incubating, <=1.11.1) +4 more potentially affected by CVE-2025-66518 +1 more via org.apache.kyuubi:kyuubi-server_2.12 (>=1.6.0-incubating, <=1.11.1)

org.apache.kyuubi:kyuubi-server2.12 MAVEN version =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.11.1 Source cves: CVE-2025-66518, CVE-2026-62391 Source advisory: MEND:CVE-2026-62391...

org.apache.kyuubi:kyuubi-assembly_2.12 (>=1.8.0, <=1.11.1), org.apache.kyuubi:kyuubi-codecov_2.12 (>=1.8.0, <=1.11.1) +4 more potentially affected by CVE-2026-23904 via org.apache.kyuubi:kyuubi-server_2.12 (>=1.8.0, <=1.11.1)

org.apache.kyuubi:kyuubi-server2.12 MAVEN version =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.11.1 Source cves: CVE-2026-23904 Source advisory: MEND:CVE-2026-23904...

CVE-2025-66518

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

org.apache.kyuubi:kyuubi-assembly_2.12 (>=1.6.0-incubating, <=1.10.2), org.apache.kyuubi:kyuubi-codecov_2.12 (>=1.6.0-incubating, <=1.10.2) +4 more potentially affected by CVE-2025-66518 via org.apache.kyuubi:kyuubi-server_2.12 (>=1.6.0-incubating, <=1.10.2)

org.apache.kyuubi:kyuubi-server2.12 MAVEN version =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.10.2 Source cves: CVE-2025-66518 Source advisory: OSV:GHSA-F8R6-6222-9PVC...

Apache Kyuubi Server vulnerable to Path Traversal

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

CVE-2025-66518

Apache Kyuubi Server 1.6.0–1.10.2 is affected by a path traversal/unauthorized local-file access vulnerability where an attacker able to reach the Kyuubi frontend could bypass the kyuubi.session.local.dir.allow.list. Root cause involves insufficient path normalization, permitting access to local ...

org.apache.kyuubi:kyuubi-assembly_2.12 (>=1.6.0-incubating, <=1.10.2), org.apache.kyuubi:kyuubi-codecov_2.12 (>=1.6.0-incubating, <=1.10.2) +4 more potentially affected by CVE-2025-66518 via org.apache.kyuubi:kyuubi-server_2.12 (>=1.6.0-incubating, <=1.10.2)

org.apache.kyuubi:kyuubi-server2.12 MAVEN version =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =1.10.2 Source cves: CVE-2025-66518 Source advisory: MEND:CVE-2025-66518...