Executive brief
Apache Kyuubi is a distributed multi-tenant gateway for data processing engines like Spark and Flink. A security flaw in its Engine UI proxy allows remote users to force the Kyuubi server to send web requests to any internal or external computer. This could allow an attacker to scan private networks, bypass firewalls, or access sensitive internal services that are not normally exposed to the internet.
Technical details
The Kyuubi Engine UI proxy component improperly validates the host and port parameters provided in the request path. A remote attacker with network access to the Kyuubi REST frontend can exploit this to perform Server-Side Request Forgery (SSRF) or use the server as an open proxy to reach arbitrary network destinations. This can lead to internal network scanning or unauthorized access to internal metadata services. The vulnerability is addressed in version 1.12.0 by disabling the proxy by default and introducing a whitelist configuration ('kyuubi.frontend.rest.engine.ui.proxy.hosts') to restrict allowed destinations.
Affected products
- Apache Software Foundation Kyuubi 1.8.0 to 1.11.x (before 1.12.0)
Timeline
- 2026-05-29: patched: Pull request to restrict proxy targets submitted
- 2026-07-29: disclosed: CVE published by Apache Software Foundation