CVE-2026-41041— Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Gravitino | 1.0.0< 1.2.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41041
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
Source: CVE Program / CVE List V5
Vulnerability Description
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
URL编码处理不恰当(Hex编码)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Gravitino 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Gravitino是美国Apache基金会开源的一款高性能、地理分布式、联邦式元数据湖，提供统一的数据和 AI 资产管理与治理框架。 Apache Gravitino 1.0.0版本至1.2.1之前版本存在输入验证错误漏洞，该漏洞源于未编码的用户提供标识符导致URL路径注入，可能导致非授权机密性和完整性影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Gravitino | 1.0.0 ~ 1.2.1 | - |
II. Public POCs for CVE-2026-41041
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41041
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-41041 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-13 · 4 CVEs total
| CVE-2026-59245 | Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-D | |
| CVE-2026-58065 | Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disab | |
| CVE-2026-49876 | Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP reque |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
- CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v - CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
Same weakness: CWE-177
- CVE-2026-59083
Apache Tomcat: Incorrect URL decoding in RewriteValve may al - CVE-2026-6414
@fastify/static vulnerable to route guard bypass via encoded - CVE-2026-29045
Hono: Arbitrary file access via serveStatic vulnerability - CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Enco - CVE-2026-22031
Fastify Middie Middleware Path Bypass
V. Comments for CVE-2026-41041
No comments yet