Junglewise Threat Intelligence

CVE-2026-49876: Apache Gravitino SSRF in JobManager via job template URIs

CVE-2026-49876 · Severity: low · CVSS 3.1 · Published 2026-07-13

Technologies: Apache Software Foundation Gravitino. Vendors: PyPI, Apache Software Foundation.

Executive brief

Apache Gravitino is a metadata management system used to manage data across different platforms. A security flaw in its JobManager component allows an authenticated user to force the server to make unauthorized network requests. This could be used to access sensitive internal network resources or cloud metadata that should not be publicly accessible, potentially leading to the exposure of internal configuration or credentials.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Apache Gravitino JobManager component due to insufficient validation of job template URIs. An authenticated attacker can provide a specially crafted URI that causes the server to initiate HTTP requests to arbitrary internal network addresses or cloud provider metadata services (e.g., IMDS). This can lead to information disclosure of internal services or cloud environment credentials. The vulnerability affects versions 1.0.0 through 1.2.1 and is resolved in version 1.3.0.

Affected products

  • Apache Software Foundation Gravitino 1.0.0 through 1.2.1

Timeline

  • 2026-07-13: disclosed
  • 2026-07-13: advisory

References

Related threats