CVE-2026-23904: Apache Kyuubi SSRF Vulnerability

CVE-2026-23904 Overview

CVE-2026-23904 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Kyuubi Engine UI proxy. The proxy accepts a host and port from the request path and forwards HTTP requests to that destination without validation. A remote attacker with network access to the proxy can force the Kyuubi server to issue HTTP requests to arbitrary reachable hosts, producing SSRF and open-proxy behavior. The flaw is tracked under CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints). It affects Apache Kyuubi from 1.8.0 before 1.12.0.

Critical Impact
Unauthenticated attackers can pivot through the Kyuubi server to reach internal services, cloud metadata endpoints, or arbitrary external hosts.

Affected Products

Apache Kyuubi 1.8.0 through releases prior to 1.12.0
Deployments exposing the Engine UI proxy endpoint to untrusted networks
Kyuubi servers with default proxy configuration prior to 1.12.0

Discovery Timeline

2026-07-29 - CVE-2026-23904 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-23904

Vulnerability Analysis

Apache Kyuubi is a distributed multi-tenant gateway for serverless SQL on data warehouses and lakehouses. The Engine UI proxy in Kyuubi forwards HTTP requests to the web UI of backend engines. Prior to version 1.12.0, the proxy parsed the destination host and port directly from the incoming request path. The server then performed an outbound HTTP request to whatever destination the requester supplied.

Because the proxy did not restrict destinations to an allowlist, any network client that could reach the Kyuubi frontend could coerce the server into acting as an HTTP relay. Attackers can use this behavior to reach services bound to the Kyuubi host's loopback interface, internal-only management APIs, or cloud provider metadata endpoints such as 169.254.169.254. The proxy also functions as an open HTTP relay to arbitrary external hosts.

Root Cause

The root cause is missing validation of the target endpoint. The Engine UI proxy trusted the request path to specify a legitimate engine location and did not enforce an allowlist of permitted hosts. This maps to CWE-923, where a channel is established with an endpoint that is not properly restricted.

Attack Vector

Exploitation requires only network access to the Kyuubi REST frontend. No authentication or user interaction is required. An attacker crafts an HTTP request to the Engine UI proxy path and embeds an arbitrary host and port. The Kyuubi server then issues the outbound request and returns the response body to the attacker. Refer to the Apache Kyuubi pull request #7483 and the Apache mailing list advisory for the upstream fix and discussion.

Detection Methods for CVE-2026-23904

Indicators of Compromise

Outbound HTTP connections originating from the Kyuubi server process to unexpected internal IP ranges or cloud metadata endpoints such as 169.254.169.254
Access log entries on the Kyuubi frontend containing Engine UI proxy paths with unusual host or port components
Unexpected traffic from the Kyuubi host to non-engine services on ports such as 22, 3306, 6379, or 8080

Detection Strategies

Inspect Kyuubi REST access logs for requests targeting the Engine UI proxy route and correlate them with the destination host embedded in the URL
Alert when the Kyuubi service account initiates HTTP connections to hosts outside the known set of Spark, Flink, or Trino engine nodes
Monitor egress firewall logs for HTTP traffic from the Kyuubi host to non-approved destinations

Monitoring Recommendations

Enable verbose logging on the Kyuubi frontend and forward logs to a centralized SIEM for retention and correlation
Baseline expected engine UI destinations and alert on deviations
Track process-level network telemetry for the Kyuubi JVM to identify anomalous outbound requests

How to Mitigate CVE-2026-23904

Immediate Actions Required

Upgrade Apache Kyuubi to version 1.12.0 or later, which disables the Engine UI proxy by default
Restrict network access to the Kyuubi REST frontend using network segmentation, firewalls, or service mesh policies
Audit historical access logs for evidence of SSRF attempts against the Engine UI proxy path

Patch Information

Apache Kyuubi 1.12.0 disables the Engine UI proxy by default. Administrators who require proxied Engine UI functionality must explicitly re-enable it by setting kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configuring an allowlist of permitted target hosts via kyuubi.frontend.rest.engine.ui.proxy.hosts. Details of the fix are documented in pull request #7483 and the Openwall oss-security thread.

Workarounds

Leave kyuubi.frontend.rest.engine.ui.proxy.enabled set to false unless the proxy is strictly required
If the proxy must be enabled, populate kyuubi.frontend.rest.engine.ui.proxy.hosts with the minimum set of engine hosts required for operation
Place the Kyuubi frontend behind an authenticated reverse proxy and block direct network access from untrusted zones

bash

# Configuration example - kyuubi-defaults.conf
kyuubi.frontend.rest.engine.ui.proxy.enabled=false

# If the proxy is required, restrict targets to known engine hosts
# kyuubi.frontend.rest.engine.ui.proxy.enabled=true
# kyuubi.frontend.rest.engine.ui.proxy.hosts=engine-host-1:4040,engine-host-2:4040