EUVD-2026-74804
GHSA-wrx6-qm3h-c589
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attacker only needs to supply a crafted file (PR:N, AV:N); three simultaneous conditions required (AC:H); KMS token exfiltrated to external attacker system (S:C, C:H); no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Apache Parquet Hadoop's envelope encryption subsystem (org.apache.parquet.crypto.keytools, versions 1.12-1.18.0) can leak KMS authentication tokens to an attacker-controlled endpoint when a crafted Parquet file embeds a malicious KMS URL and the reader application relies on file-controlled URL resolution. The pluggable KmsClient receives the file-embedded URL without host validation, allowing a file author to silently redirect KMS token requests to an arbitrary server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must control or be able to modify the Parquet file being read, embedding a malicious KMS URL in the file's encryption metadata; (2) the reader application must use file-controlled KMS URL resolution, meaning it does not override the KMS URL at the application layer; and (3) the pluggable KmsClient implementation in use must not perform its own host validation on the received URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 'moderate' severity designation from Apache reflects the conditional nature of exploitation: three independent preconditions must align simultaneously - the attacker controls the Parquet file, the reader uses file-controlled KMS URL resolution rather than application-controlled resolution, and the KmsClient implementation omits host validation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Parquet Java version 1.18.1 or later; this release disables file-controlled KMS URLs by default and introduces a new application parameter that must be explicitly set to re-enable them, with documentation requiring host validation and authentication in any custom KmsClient. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Apache Parquet versions 1.12-1.18.0 and assess exposure to untrusted or user-supplied Parquet files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today