Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92287— Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Quick assessment

Affected
Apache Software Foundation Apache Arrow C++
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache C++ Parquet 和 PyArrow 版本 4.0.0 至 25.0.1 中存在未经验证的 KMS（密钥管理服务）URL 透传至 KMS 客户端的漏洞。 该漏洞影响读取 Parquet 文件并配置了带有 KmsClient 实现的 Parquet 解密属性的用户。 在读取端，KMS URL 可由应用程序控制（通过 KmsConnectionConfig 指定），也可由文件内容控制。若用户未采用应用程序控制方式管理该参数，则由文件控制的 KMS URL 将被转发给可插拔的 KmsClient 实现

AI Predicted 7.5 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92287

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Source: CVE Program / CVE List V5
Vulnerability Description
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious host set by an attacker in the file.  Users are recommended to upgrade to version 26.0.0, which disables this behavior by default and requires that users opt-in to it by enabling the read_kms_url flag in the DecryptionConfiguration. Users of affected versions are recommended to either specify the KMS URL in the KmsConnectionConfig when reading files, or ensure any KmsClient implementations validate received KMS URLs. Users that opt-in to file-controlled KMS URLs in version 26.0.0 and later must ensure KmsClients validate KMS URLs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Arrow C++ 4.0.0 ~ 26.0.0 -
Apache Software Foundation PyArrow 8.0.0 ~ 26.0.0 -

II. Public POCs for CVE-2026-92287

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92287

请登录查看更多情报信息。

Other References for CVE-2026-92287 (2)

Same Patch Batch · Apache Software Foundation · 2026-10-20 · 6 CVEs total

CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces
CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning
CVE-2026-108087 Apache Cocoon: SQL Injection
CVE-2026-108086 Apache Cocoon: XEE could lead to SSRF and information disclosure
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the atta

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-20

V. Comments for CVE-2026-92287

No comments yet

Leave a comment