Apache Gravitino vulnerabilities

2 known vulnerabilities in Apache Gravitino from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache Gravitino: Improper Handling of URL Encoding (Hex Encoding)

  CVE-2026-41041Jul 13, 2026Apache

  URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

• 9.1 Critical severity

  Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API…

  CVE-2026-41042Jul 8, 2026ApacheEPSS 1.51%

  Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are