Apache Kyuubi
Monthly
Path traversal bypass in Apache Kyuubi 1.6.0-1.11.x allows any authenticated client accessing the server via Kyuubi frontend protocols to circumvent the server-side `kyuubi.session.local.dir.allowlist` security control by supplying unprefixed Spark configuration aliases. This represents an incomplete remediation of CVE-2025-66518, meaning the original attack surface was known and partially disclosed before this variant was identified. With CVSS 8.1 (C:H, I:H), exploitation could allow reading or writing arbitrary files accessible to the Kyuubi service account. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal bypass in Apache Kyuubi 1.6.0-1.11.x allows any authenticated client accessing the server via Kyuubi frontend protocols to circumvent the server-side `kyuubi.session.local.dir.allowlist` security control by supplying unprefixed Spark configuration aliases. This represents an incomplete remediation of CVE-2025-66518, meaning the original attack surface was known and partially disclosed before this variant was identified. With CVSS 8.1 (C:H, I:H), exploitation could allow reading or writing arbitrary files accessible to the Kyuubi service account. No public exploit or CISA KEV listing has been identified at time of analysis.