Which versions of Apache Kvrocks are affected by CVE-2026-41566?

Apache Kvrocks contains a critical privilege escalation vulnerability that allows authenticated low-privilege users to bypass the server's access control model and directly manipulate the underlying…

How to fix or mitigate CVE-2026-41566?

Within 24 hours: Inventory all Apache Kvrocks deployments; audit which systems allow untrusted or low-privilege user access; implement network-level restrictions (firewall rules, VPN requirements) limiting Kvrocks server access to trusted internal networks only. Within 7 days: Disable the APPLYBATCH command at the application layer or proxy if operationally feasible; enable comprehensive audit logging for all Kvrocks commands with user identity and source IP context; deploy alerting for APPLYBATCH usage and ACL bypass attempts. Within 30 days: Monitor Apache Kvrocks project releases for CVE-2026-41566 patch availability; conduct privilege audit removing unnecessary write permissions from all low-privilege service accounts; stage and validate patched Kvrocks version in non-production environment; deploy production patch within 48 hours of vendor release.

Apache Kvrocks CVE-2026-41566

Q: What is the CVSS score of CVE-2026-41566?

CVE-2026-41566 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:M/U:Amber. EPSS exploitation probability: 0.3%.

EUVD-2026-39335 CRITICAL

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-06-25

GHSA-q7pc-rp7q-9q3m

Path Traversal Apache

9.4

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:M/U:Amber

vuln.today AI

8.3 HIGH

Network-reachable command needing a low-privilege authenticated session (PR:L, AV:N, AC:L); bypassing permissions to apply raw write batches yields high integrity/availability and limited confidentiality impact; no UI realistically required.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:M/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 25, 2026 - 09:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 25, 2026 - 09:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 25, 2026 - 09:23 vuln.today

cvss_changed

CVSS changed

Jun 25, 2026 - 09:23 NVD

9.4 (CRITICAL)

Analysis Generated

Jun 25, 2026 - 04:47 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Privilege Bypass in Apache Kvrocks - CVE-2026-41566 Jun 26, 2026

AnalysisAI

Privilege bypass in Apache Kvrocks exposes the internal APPLYBATCH command without proper permission enforcement, letting an authenticated low-privilege client write raw batches directly to the underlying RocksDB storage engine and bypass the server's command ACL model. The flaw (CWE-280, improper handling of permissions) carries a CVSS 4.0 base of 9.4 due to high integrity and availability impact and an irrecoverable-damage recovery rating. No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was disclosed pre-NVD via the oss-security mailing list on 2026-06-25 alongside two sibling Kvrocks CVEs.

Technical ContextAI

Apache Kvrocks is a distributed, Redis-protocol-compatible NoSQL key-value datastore that persists data on Facebook's RocksDB LSM-tree storage engine, commonly used as a disk-based replacement for in-memory Redis. APPLYBATCH is an internal/administrative command Kvrocks uses to apply serialized RocksDB write batches (notably as part of replication and bulk-apply paths), which mutate the storage engine directly beneath the normal command and ACL layer. CWE-280 (Improper Handling of Insufficient Permissions or Privileges) is the root-cause class here: the command was reachable by principals whose privilege level should not allow direct batch application, so the authorization check that should gate this powerful primitive was missing or incorrectly enforced. Note the input 'Path Traversal' tag actually corresponds to the sibling advisory CVE-2026-45188 (replication fullsync path traversal) listed in the same oss-security post - CVE-2026-41566 itself is a permission/authorization defect, not a path-traversal bug.

RemediationAI

Upgrade to the fixed Apache Kvrocks release identified in the official advisory thread at https://lists.apache.org/thread/zng5lp7psgkcv9jnm9tztdlm3rmzfydl; the exact patched version is not present in the provided data and must be read from that advisory rather than invented (Patch available per vendor advisory; specific fix version not independently confirmed from input). As compensating controls until patched: restrict network access to the Kvrocks port (default 6666) so only trusted application hosts can connect, enforce strong Redis-style AUTH/requirepass and per-user ACLs to minimize the number of low-privilege accounts that could reach the command, and if your Kvrocks build supports rename-command/command-disabling, disable or rename APPLYBATCH for client-facing access (trade-off: this can break replication or bulk-apply tooling that legitimately uses it, so test in staging first). Place Kvrocks behind a network segment that excludes untrusted tenants, accepting that this does not help against an already-authenticated malicious low-privilege client.