Apache Kyuubi CVE-2026-23904

The Engine UI proxy feature must be present, which restricts exploitation to Kyuubi versions 1.8.0 through 1.11.x. In these versions the proxy is enabled by default with no host allowlist, meaning any requester with network-level access to the Kyuubi REST frontend port can trigger the SSRF. No authentication is indicated by the description - the advisory states 'a remote requester with network access to the proxy' without any credential prerequisite, and no CVSS PR metric is available to independently confirm this. The primary limiting factor is network access: Kyuubi is typically deployed as an internal data platform service not directly exposed to the internet, so exploitation realistically requires the attacker to already have a foothold on the internal network or for the Kyuubi REST port to be inadvertently internet-exposed. In 1.12.0 the proxy is disabled by default, so upgraded instances are not vulnerable unless the operator explicitly re-enables the proxy without configuring the host allowlist.

No CVSS vector was provided with this advisory; the severity is labeled 'moderate' by the Apache project. Independent assessment places this at CVSS 3.1 ~6.1-7.2 range depending on deployment exposure, driven by network-accessible, unauthenticated, low-complexity exploitation. The primary risk is SSRF enabling an attacker to probe internal network topology, interact with metadata services (e.g., cloud IMDS endpoints on AWS/GCP/Azure), or pivot to internal APIs not directly reachable from the internet. The open-proxy aspect additionally allows the Kyuubi server's egress IP to be used to interact with third-party services, bypassing IP-based allowlists. EPSS data is not available for this CVE at time of analysis. Exploitation is straightforward and requires no credentials, but the realistic blast radius is constrained by how broadly the Kyuubi REST endpoint is internet-exposed - in typical enterprise deployments, Kyuubi sits on an internal data platform network, which limits opportunistic exploitation. The absence of a KEV listing and no known POC reduces urgency, though the trivial attack complexity means any threat actor with network access could exploit this without tooling.

An attacker with network access to the Kyuubi REST API constructs a crafted HTTP request to the engine.ui.proxy endpoint, embedding a target URL pointing to an internal metadata service such as the AWS Instance Metadata Service at 169.254.169.254 or an internal administrative API. The Kyuubi server dutifully forwards the request and returns the response to the attacker, disclosing IAM credentials or internal service data. No authentication or special tooling is required - a standard HTTP client and knowledge of the endpoint path is sufficient.