# CVE-2026-41042: Apache Gravitino RCE via malicious H2 JDBC URL in testConnection API

Source: https://junglewise.ai/threats/cve-2026-41042-apache-gravitino-rce-via-malicious-h2-jdbc-url-in-testconnection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-41042 · Severity: info · CVSS 0 · Published 2026-07-08

Apache Gravitino, a metadata management system, contains a vulnerability that allows unauthenticated users to execute malicious code on the server. By providing a specially crafted database connection URL, an attacker can trigger the execution of arbitrary Java code. This could lead to a complete takeover of the server, though the risk is mitigated if the software is only used in internal development or testing environments.

Technologies: [Apache Software Foundation Gravitino](https://junglewise.ai/threats/technologies/gravitino). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-41042 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41042 being exploited in the wild.

**How severe is CVE-2026-41042?** Informational severity, with a CVSS score of 0, published 8 July 2026.

**Which products and versions are affected?** Apache Software Foundation Gravitino before 1.2.1.

**Is there a fix for CVE-2026-41042?** A patch was published on 2026-07-08: Version 1.2.1 released to fix the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41042 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41042?** Check whether you run Apache Software Foundation Gravitino at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Apache Gravitino is vulnerable to remote code execution (RCE) via improper input validation in its testConnection API. An unauthenticated attacker can provide a malicious H2 JDBC connection string containing the 'INIT' parameter. This parameter allows the execution of arbitrary SQL commands, which in the H2 database engine can be leveraged to execute arbitrary Java code on the host server. The vulnerability is present in versions prior to 1.2.1. While the impact is high, the vendor notes that H2 is primarily used for local development and testing, and Gravitino is typically deployed within internal networks. Users should upgrade to version 1.2.1 to remediate this issue.

## Affected products

- Apache Software Foundation Gravitino before 1.2.1

## Timeline

- 2026-07-08: advisory: NVD publication date
- 2026-07-08: patched: Version 1.2.1 released to fix the issue

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm](https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm)

## Related threats

- [Apache Gravitino SSRF in JobManager via job template URIs](https://junglewise.ai/threats/cve-2026-49876-apache-gravitino-ssrf-in-jobmanager-via-job-template-uris)
- [Apache Gravitino URL path injection via unencoded identifiers](https://junglewise.ai/threats/cve-2026-41041-apache-gravitino-url-path-injection-via-unencoded-identifiers)
- [Apache Gravitino SQL injection in UI](https://junglewise.ai/threats/cve-2025-53648-apache-gravitino-sql-injection-in-ui)