CVE-2026-41042— Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Gravitino | < 1.2.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41042
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
Source: NVD (National Vulnerability Database)
Vulnerability Description
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Gravitino 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Apache Gravitino是美国Apache基金会开源的一款高性能、地理分布式、联邦式元数据湖，提供统一的数据和 AI 资产管理与治理框架。 Apache Gravitini 1.2.1之前版本存在输入验证错误漏洞，该漏洞源于输入验证错误，可能导致未经身份验证的攻击者通过testConnection API提供恶意H2 JDBC URL，进而通过H2的INIT参数在服务器上执行任意Java代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Gravitino | 0 ~ 1.2.1 | - |
II. Public POCs for CVE-2026-41042
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41042
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-41042 (1)
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
- CVE-2026-56623
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git - CVE-2026-56624
Apache MINA SSHD: SSH certificate options lack validations - CVE-2026-58624
Apache MINA SSHD: Remote execution of JGit commands can writ - CVE-2026-56452
Apache MINA SSHD: Path traversal in SCP file reception - CVE-2026-62418
Apache Syncope: Low-privileged authenticated SSRF in Connect
Same weakness: CWE-20
- CVE-2026-47255
AgenticMail API/storage and outbound relay hardening - CVE-2026-58624
Apache MINA SSHD: Remote execution of JGit commands can writ - CVE-2026-47198
Paymenter: URL parameter injection bypasses paid plan limits - CVE-2026-44978
xrdp: Unchecked FIPS padding length in standard RDP Security - CVE-2026-35048
Piwigo RCE via PHP Code Injection into Config File in Instal
V. Comments for CVE-2026-41042
No comments yet