What is the CVSS score of CVE-2026-41042?

CVE-2026-41042 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache Gravitino are affected by CVE-2026-41042?

Apache Gravitino versions before 1.2.1 contain an unauthenticated remote code execution vulnerability affecting organizations that deploy Gravitino with H2 database backends.. A patch is available.

How to fix or mitigate CVE-2026-41042?

Within 24 hours: Audit all Gravitino deployments to identify instances using H2 database and assess network exposure. Within 7 days: Upgrade all affected Gravitino instances to version 1.2.1 or later; if H2 cannot be updated, restrict network access to the service. Within 30 days: Complete deployment assessment, validate production environments use non-H2 databases, and establish policy prohibiting H2 in production.

Apache Gravitino CVE-2026-41042

EUVD-2026-42221 CRITICAL

Improper Input Validation (CWE-20)

2026-07-08 apache

GHSA-2q68-xwfj-2rpc

Java RCE Apache Apache Gravitino

9.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.1 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Unauthenticated network RCE (PR:N, AV:N) with full code execution impacting C/I/A:H, but AC:H because it depends on the non-default, attacker-uncontrolled H2 backend configuration.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 08, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 08, 2026 - 16:22 NVD

LOW CRITICAL

CVSS changed

Jul 08, 2026 - 16:22 NVD

9.1 (LOW) 9.1 (CRITICAL)

Patch available

Jul 08, 2026 - 13:01 EUVD

Analysis Generated

Jul 08, 2026 - 12:44 vuln.today

DescriptionCVE.org

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Articles & Coverage 1

News Critical RCE in Apache Gravitino via H2 JDBC URL - CVE-2026-41042 Jul 08, 2026

AnalysisAI

Remote code execution in Apache Gravitino before 1.2.1 allows unauthenticated callers to abuse the testConnection API by submitting a crafted H2 JDBC URL whose INIT parameter runs arbitrary Java on the server. The flaw only manifests when Gravitino is backed by the H2 database - a configuration primarily used for testing and local development - and CISA SSVC rates technical impact as total and exploitation as automatable, though no public exploit has surfaced. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed Gravitino testConnection API

Delivery

Submit malicious H2 JDBC URL

Exploit

H2 INIT parameter parsed

Execution

Arbitrary Java executed on server

Impact

Full server compromise

Access

Reach exposed Gravitino testConnection API

Delivery

Submit malicious H2 JDBC URL

Exploit

H2 INIT parameter parsed

Execution

Arbitrary Java executed on server

Impact

Full server compromise

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target Gravitino instance be configured to use the H2 database backend (per the advisory, 'this issue only happens when using H2'), which is chiefly a testing/local-development configuration rather than a production default - this is the key limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals conflict and must be weighed together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a network-exposed, H2-backed Gravitino instance sends a single unauthenticated request to the testConnection API containing an H2 JDBC URL with a malicious INIT parameter. H2 executes the embedded statements at connection time, running attacker-supplied Java code on the server. …
Remediation	Upgrade to Apache Gravitino 1.2.1, which fixes the issue (Vendor-released patch: 1.2.1); this is the primary and recommended action per the Apache advisory at https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm. … Detailed patch versions, workarounds, and compensating controls in full report.