CVE-2026-62391

Apache Kyuubi versions 1.6.0 before 1.12.0 are vulnerable to Directory Traversal due to incomplete fixes for CVE-2025-66518. An attacker can bypass the kyuubi.session.local.dir.allowlist configuration by submitting Spark frontend requests that use unprefixed Spark config aliases (such as files) i...