Kyuubi (Apache) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 110 known versions, newest CVE from 2026-07-31. Vendor: Apache.

CVEs of Kyuubi

• CVE-2026-62391 - CVSS 8.1 (high), 2026-07-31: The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side…
• CVE-2026-52680 - CVSS 9.8 (critical), 2026-07-30: Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker…
• CVE-2026-23904 - CVSS 7.3 (high), 2026-07-29: Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to…
• CVE-2025-66518 - CVSS 8.8 (high), 2026-01-05: Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use…