What is the CVSS score of CVE-2026-62391?

CVE-2026-62391 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache Kyuubi are affected by CVE-2026-62391?

Apache Kyuubi 1.6.0 through 1.11.x contains a path traversal vulnerability affecting authenticated users that bypasses the allowlist security control, potentially exposing arbitrary file access to…. A patch is available.

How to fix or mitigate CVE-2026-62391?

Within 24 hours, inventory all Apache Kyuubi deployments and verify which versions are running across your infrastructure; immediately restrict network access to Kyuubi services to trusted clients only and review recent access logs for suspicious authentication patterns. Within 7 days, apply the vendor-released security patch to all affected Kyuubi instances (versions 1.6.0 through 1.11.x) and validate the patched kyuubi.session.local.dir.allowlist control is properly enforced. Within 30 days, conduct a full audit of file access patterns on systems running Kyuubi to detect any indicators of compromise from the vulnerability window.

Apache Kyuubi CVE-2026-62391

EUVD-2026-51518 HIGH

Path Traversal (CWE-22)

2026-07-31 apache

GHSA-pp6r-c7gq-g5pr

Apache Path Traversal Apache Kyuubi Apache Software Foundation

8.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

PR:L confirmed by authenticated-user requirement; C:H and I:H reflect arbitrary file read/write as the service account; A:N as no availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 31, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jul 31, 2026 - 17:22 NVD

8.1 (HIGH)

Patch available

Jul 31, 2026 - 11:02 EUVD

Analysis Generated

Jul 31, 2026 - 10:51 vuln.today

CVE Published

Jul 31, 2026 - 09:58 cve.org

HIGH

DescriptionCVE.org

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases.

This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

AnalysisAI

Path traversal bypass in Apache Kyuubi 1.6.0-1.11.x allows any authenticated client accessing the server via Kyuubi frontend protocols to circumvent the server-side kyuubi.session.local.dir.allowlist security control by supplying unprefixed Spark configuration aliases. This represents an incomplete remediation of CVE-2025-66518, meaning the original attack surface was known and partially disclosed before this variant was identified. With CVSS 8.1 (C:H, I:H), exploitation could allow reading or writing arbitrary files accessible to the Kyuubi service account. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache Kyuubi is an enterprise SQL gateway that fronts Apache Spark and other execution engines, exposing multiple frontend protocols including Thrift and REST for SQL workload submission. The kyuubi.session.local.dir.allowlist is a server-side security control introduced to restrict which local filesystem directories clients may reference when configuring Spark sessions - a guard against path traversal via Spark config injection. The root cause (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) persists because Apache Spark supports unprefixed aliases for many configuration keys (e.g., a short-form alias that resolves to the same setting as the fully prefixed key). The original fix validated only the canonical prefixed form, leaving the alias form unchecked. When Spark resolves the alias at runtime, it bypasses the allowlist entirely. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_kyuubi:*:*:*:*:*:*:*:* covering versions 1.6.0 through 1.11.x.

RemediationAI

Upgrade Apache Kyuubi to version 1.12.0, which is confirmed by the vendor to contain the complete fix for both CVE-2026-62391 and its predecessor CVE-2025-66518; the advisory is at https://lists.apache.org/thread/vo4k4nxz23kfzrpp120nsojb0vrkx4w1. If an immediate upgrade is not feasible, restrict network access to all Kyuubi frontend protocol endpoints (Thrift on port 10009, REST API) to only trusted internal clients using network-layer controls such as firewall rules or a service mesh policy - this reduces the pool of potential exploiters but does not eliminate the vulnerability for authenticated internal users. Additionally, review the OS-level permissions of the Kyuubi service account and apply the principle of least privilege to limit which local directories the process can access, reducing the blast radius of a successful allowlist bypass. Note that neither workaround constitutes a complete fix; patching to 1.12.0 is the only vendor-confirmed remediation.