Executive brief
Apache Gravitino is a metadata management system used to manage data across different platforms. A security flaw in its JobManager component allows an authenticated user to force the server to make unauthorized network requests. This could be used to access sensitive internal network resources or cloud metadata that should not be publicly accessible, potentially leading to the exposure of internal configuration or credentials.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Apache Gravitino JobManager component due to insufficient validation of job template URIs. An authenticated attacker can provide a specially crafted URI that causes the server to initiate HTTP requests to arbitrary internal network addresses or cloud provider metadata services (e.g., IMDS). This can lead to information disclosure of internal services or cloud environment credentials. The vulnerability affects versions 1.0.0 through 1.2.1 and is resolved in version 1.3.0.
Affected products
- Apache Software Foundation Gravitino 1.0.0 through 1.2.1
Timeline
- 2026-07-13: disclosed
- 2026-07-13: advisory