Apache Kyuubi
4 CVEs affecting Apache Kyuubi. Latest disclosed: 2026-07-31. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52680 | Critical | 9.8 | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker w… |
CVE-2025-66518 | High | 8.8 | 2026-01-05 | Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local… |
CVE-2026-62391 | High | 8.1 | 2026-07-31 | The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side confi… |
CVE-2026-23904 | High | 7.3 | 2026-07-29 | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to t… |