Kyuubi vulnerabilities
4 known vulnerabilities in Kyuubi from Apache. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Apache Kyuubi: Improper Limitation of a Pathname to a Restricted Directory
The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache K
- 9.8 Critical severity
Apache Kyuubi: Improper Limitation of a Pathname to a Restricted Directory
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and
- 7.3 High severity
Apache Kyuubi: Improper Restriction of Communication Channel to Intended Endpoints
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in
- 8.8 High severity
Apache Kyuubi: Improper Limitation of a Pathname to a Restricted Directory
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.