# CVE-2026-62391: Apache Kyuubi path traversal via Spark config alias bypass

Source: https://junglewise.ai/threats/cve-2026-62391-apache-kyuubi-path-traversal-via-spark-config-alias-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-62391 · Severity: info · CVSS 0 · Published 2026-07-31

Apache Kyuubi is a distributed multi-tenant gateway for large-scale data processing and SQL analytics. A security flaw has been identified where the server's directory restrictions can be bypassed, potentially allowing unauthorized access to local files or directories on the server. This could lead to the exposure of sensitive configuration data or operational disruption.

Technologies: [Apache Software Foundation Kyuubi](https://junglewise.ai/threats/technologies/kyuubi). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-62391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62391 being exploited in the wild.

**How severe is CVE-2026-62391?** Informational severity, with a CVSS score of 0, published 31 July 2026.

**Which products and versions are affected?** Apache Software Foundation Kyuubi 1.6.0 to 1.11.x (before 1.12.0).

**Is there a fix for CVE-2026-62391?** A patch was published on 2026-07-31. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62391 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62391?** Check whether you run Apache Software Foundation Kyuubi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a path traversal and configuration bypass (CWE-22, CWE-27) resulting from an incomplete fix for a previous vulnerability. An attacker with access to the Kyuubi Server via frontend protocols can bypass the 'kyuubi.session.local.dir.allowlist' server-side configuration. This is achieved by using unprefixed Spark configuration aliases that the server fails to properly validate or restrict. This allows the client to specify local directories outside of the intended allowlist. The issue is resolved in Apache Kyuubi version 1.12.0.

## Affected products

- Apache Software Foundation Kyuubi 1.6.0 to 1.11.x (before 1.12.0)

## Timeline

- 2026-07-31: advisory
- 2026-07-31: disclosed
- 2026-07-31: patched

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/vo4k4nxz23kfzrpp120nsojb0vrkx4w1](https://lists.apache.org/thread/vo4k4nxz23kfzrpp120nsojb0vrkx4w1)

## Related threats

- [Apache Kyuubi path traversal in REST batch multipart upload](https://junglewise.ai/threats/cve-2026-52680-apache-kyuubi-path-traversal-in-rest-batch-multipart-upload)
- [Apache Kyuubi SSRF in Engine UI proxy](https://junglewise.ai/threats/cve-2026-23904-apache-kyuubi-ssrf-in-engine-ui-proxy)