Executive brief
Apache Kyuubi is a distributed multi-tenant gateway for large-scale data processing and SQL analytics. A security flaw has been identified where the server's directory restrictions can be bypassed, potentially allowing unauthorized access to local files or directories on the server. This could lead to the exposure of sensitive configuration data or operational disruption.
Technical details
This vulnerability is a path traversal and configuration bypass (CWE-22, CWE-27) resulting from an incomplete fix for a previous vulnerability. An attacker with access to the Kyuubi Server via frontend protocols can bypass the 'kyuubi.session.local.dir.allowlist' server-side configuration. This is achieved by using unprefixed Spark configuration aliases that the server fails to properly validate or restrict. This allows the client to specify local directories outside of the intended allowlist. The issue is resolved in Apache Kyuubi version 1.12.0.
Affected products
- Apache Software Foundation Kyuubi 1.6.0 to 1.11.x (before 1.12.0)
Timeline
- 2026-07-31: advisory
- 2026-07-31: disclosed
- 2026-07-31: patched