Quick answers
- Is CVE-2026-41042 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41042 being exploited in the wild.
- How severe is CVE-2026-41042?
- Informational severity, with a CVSS score of 0, published 8 July 2026.
- Which products and versions are affected?
- Apache Software Foundation Gravitino before 1.2.1.
- Is there a fix for CVE-2026-41042?
- A patch was published on 2026-07-08: Version 1.2.1 released to fix the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41042 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-41042?
- Check whether you run Apache Software Foundation Gravitino at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Apache Gravitino is vulnerable to remote code execution (RCE) via improper input validation in its testConnection API. An unauthenticated attacker can provide a malicious H2 JDBC connection string containing the 'INIT' parameter. This parameter allows the execution of arbitrary SQL commands, which in the H2 database engine can be leveraged to execute arbitrary Java code on the host server. The vulnerability is present in versions prior to 1.2.1. While the impact is high, the vendor notes that H2 is primarily used for local development and testing, and Gravitino is typically deployed within internal networks. Users should upgrade to version 1.2.1 to remediate this issue.
Affected products
- Apache Software Foundation Gravitino before 1.2.1
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: patched: Version 1.2.1 released to fix the issue