Skip to content
fr Sign in
8.8 High

CVE-2025-66518 Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config…

Description

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Kyuubi 1.6 1.6.0 → 1.10.2 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Kyuubi

The 4 CVEs of Apache Kyuubi →
CVE-2026-62391 The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend… Not rated CVE-2026-52680 Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary… Not rated CVE-2026-23904 Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A… Not rated
Track this CVE