Apache Arrow EUVD-2026-104836

Exploitation requires ALL of the following victim-side conditions: (1) the victim reads an attacker-supplied Parquet file; (2) Parquet decryption is configured with a pluggable KmsClient implementation; (3) the victim does NOT specify the KMS URL in KmsConnectionConfig (application control), leaving the URL file-controlled; and (4) the KmsClient implementation does not perform host validation and actually connects to the provided URL with a token. Limiting/mitigating factors: setting the KMS URL in KmsConnectionConfig, or having the KmsClient validate received KMS URLs, fully prevents the leak; version 26.0.0 disables file-controlled URLs by default (opt-in via the read_kms_url flag). Applies only to Arrow C++/PyArrow 4.0.0-25.0.1 where Parquet modular encryption with a custom KmsClient is in use; default deployments that do not use KMS-backed Parquet decryption are unaffected.

No CVSS vector, CWE, EPSS score, KEV entry, or public POC is present in the supplied data; the only severity signal is Apache's self-assigned 'moderate' rating. All exploitation-probability and exploitation-status signals are therefore absent, so risk must be reasoned from the description alone. The flaw is a credential-disclosure (SSRF-style token exfiltration): a file-controlled KMS URL is forwarded to a pluggable KmsClient, and if that client neither validates the host nor is overridden by an application-set URL, it sends its KMS authentication token to an attacker-chosen host. Exploitation is heavily gated by victim-side configuration (custom KmsClient that skips host validation AND no application-controlled URL in KmsConnectionConfig), which lowers real-world likelihood considerably despite the product's enormous install base - this is high prevalence but low realistic exploitation surface. It is not a drop-everything priority: treat it as a targeted-risk, config-dependent confidentiality issue for organizations that specifically use Parquet modular encryption with their own KmsClient. No KEV listing and no POC means 'no public exploit identified at time of analysis' - do not treat as actively exploited. Because no CVSS vector was provided, authentication requirements are not confirmed from available data.

An attacker crafts a Parquet file embedding a KMS URL pointing to an attacker-controlled host and delivers it into a victim data pipeline that reads Parquet files with decryption configured against a pluggable KmsClient. If the victim has not set an application-controlled KMS URL and the KmsClient does not validate the host, reading the file causes the client to transmit its KMS token to the attacker's server, leaking a credential usable to access encryption keys. No public exploit is identified at time of analysis, and the attack requires the victim's specific KMS configuration to be present.