What is CVE-2026-41042?

CVE-2026-41042 is a critical-severity vulnerability in Apache Software Foundation Gravitino, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2026-07-08.

How severe is CVE-2026-41042?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Is CVE-2026-41042 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Apache Software Foundation Gravitino

CVE-2026-41042

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.010 (59.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Apache Software Foundation Gravitino — versions 0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

Lulztigre/cve-2026-41042

References

security@apache.org (vendor-advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-41042?: CVE-2026-41042 is a critical-severity vulnerability in Apache Software Foundation Gravitino, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2026-07-08.
How severe is CVE-2026-41042?: Critical severity. CVSS v3 base score is 9.1 out of 10.
Is CVE-2026-41042 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.