Executive brief
Apache Gravitino, a metadata management system, contains a vulnerability that allows unauthenticated users to execute malicious code on the server. By providing a specially crafted database connection URL, an attacker can trigger the execution of arbitrary Java code. This could lead to a complete takeover of the server, though the risk is mitigated if the software is only used in internal development or testing environments.
Technical details
Apache Gravitino is vulnerable to remote code execution (RCE) via improper input validation in its testConnection API. An unauthenticated attacker can provide a malicious H2 JDBC connection string containing the 'INIT' parameter. This parameter allows the execution of arbitrary SQL commands, which in the H2 database engine can be leveraged to execute arbitrary Java code on the host server. The vulnerability is present in versions prior to 1.2.1. While the impact is high, the vendor notes that H2 is primarily used for local development and testing, and Gravitino is typically deployed within internal networks. Users should upgrade to version 1.2.1 to remediate this issue.
Affected products
- Apache Software Foundation Gravitino before 1.2.1
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: patched: Version 1.2.1 released to fix the issue