CVE-2026-62391 Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2025-66518

creationtimestamp| type| source ---|---|--- 2026-01-05 08:56:36+00:00| seen| https://seclists.org/oss-sec/2026/q1/11 2026-01-05 10:02:34+00:00| published-proof-of-concept| Telegram/UCM3N0VAiIL0X9q05DMaRnnlz6r5GWtUQVOA9u8gPZf080 2026-01-06 03:41:28+00:00| seen|...