CVE-2026-62391

CVE-2026-62391 affects Apache Kyuubi prior to 1.12.0. The issue allows bypass of the server-side config kyuubi.session.local.dir.allowlist by using unprefixed Spark config aliases, enabling clients that can reach the Kyuubi Server via Kyuubi frontend protocols to bypass the allowlist. Root cause:...