What is the CVSS score of CVE-2026-41042?

CVE-2026-41042 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache Gravitino are affected by CVE-2026-41042?

Apache Gravitino versions before 1.2.1 contain an unauthenticated remote code execution vulnerability affecting organizations that deploy Gravitino with H2 database backends.. A patch is available.

Is there a public PoC exploit available for CVE-2026-41042?

Yes, a public proof-of-concept exploit is available for CVE-2026-41042. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-41042?

Within 24 hours: Audit all Gravitino deployments to identify instances using H2 database and assess network exposure. Within 7 days: Upgrade all affected Gravitino instances to version 1.2.1 or later; if H2 cannot be updated, restrict network access to the service. Within 30 days: Complete deployment assessment, validate production environments use non-H2 databases, and establish policy prohibiting H2 in production.

Apache Gravitino CVE-2026-41042

EUVD-2026-42221 CRITICAL

Improper Input Validation (CWE-20)

2026-07-08 apache

GHSA-2q68-xwfj-2rpc

RCE Apache Java Apache Gravitino Apache Software Foundation

9.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.1 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Unauthenticated network RCE (PR:N, AV:N) with full code execution impacting C/I/A:H, but AC:H because it depends on the non-default, attacker-uncontrolled H2 backend configuration.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 08, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 08, 2026 - 16:22 NVD

LOW CRITICAL

CVSS changed

Jul 08, 2026 - 16:22 NVD

9.1 (LOW) 9.1 (CRITICAL)

Patch available

Jul 08, 2026 - 13:01 EUVD

Analysis Generated

Jul 08, 2026 - 12:44 vuln.today

DescriptionCVE.org

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Articles & Coverage 1

News Critical RCE in Apache Gravitino via H2 JDBC URL - CVE-2026-41042 Jul 08, 2026

AnalysisAI

Remote code execution in Apache Gravitino before 1.2.1 allows unauthenticated callers to abuse the testConnection API by submitting a crafted H2 JDBC URL whose INIT parameter runs arbitrary Java on the server. The flaw only manifests when Gravitino is backed by the H2 database - a configuration primarily used for testing and local development - and CISA SSVC rates technical impact as total and exploitation as automatable, though no public exploit has surfaced. Fixed in 1.2.1; because Gravitino is usually deployed on internal networks and H2 is not the production default, the vendor characterizes real-world severity as low despite the 9.1 CVSS score.

Technical ContextAI

Apache Gravitino is a metadata lake / data-catalog service that federates metadata across data sources; it exposes REST APIs including a testConnection endpoint used to validate backend connectivity. The H2 database (an embedded Java SQL engine) supports an INIT connection parameter in its JDBC URL that executes SQL - and, via H2 features such as CREATE ALIAS ... AS with Java source, arbitrary Java code - at connection time. Because Gravitino passes an attacker-influenced JDBC URL to H2 without validating or restricting it, this is a classic CWE-20 (Improper Input Validation) failure that converts an untrusted URL into server-side code execution. The affected component per CPE is cpe:2.3:a:apache_software_foundation:apache_gravitino, all versions prior to 1.2.1.

RemediationAI

Upgrade to Apache Gravitino 1.2.1, which fixes the issue (Vendor-released patch: 1.2.1); this is the primary and recommended action per the Apache advisory at https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm. If immediate patching is not possible, the most effective compensating control is to stop using the H2 backend and migrate to a production database (e.g. MySQL/PostgreSQL), since the flaw only triggers with H2 - with the trade-off of a backend migration effort. Additionally, restrict network access to the Gravitino API and specifically the testConnection endpoint to trusted management networks or authenticated proxies, keeping the service off untrusted networks (trade-off: may disrupt automation or tooling that calls the API remotely). Do not expose H2-backed instances to shared or internet-facing networks.