CVE-2026-41042: Apache Gravitino RCE Vulnerability

CVE-2026-41042 Overview

CVE-2026-41042 is a remote code execution flaw in Apache Gravitino versions prior to 1.2.1. Unauthenticated callers can submit a crafted H2 Java Database Connectivity (JDBC) URL through the testConnection API. The H2 database engine processes the URL's INIT parameter and executes arbitrary Java code on the Gravitino server. The Apache Software Foundation released version 1.2.1 to remediate the issue. The flaw is classified under [CWE-20] Improper Input Validation. Exploitation requires the target instance to use H2, which is typically limited to testing and local development environments.

Critical Impact
An unauthenticated network attacker can achieve arbitrary Java code execution on the Gravitino server by supplying a malicious H2 JDBC URL through the testConnection endpoint.

Affected Products

Apache Gravitino versions before 1.2.1
Deployments configured with the H2 database backend
Apache Gravitino 1.2.1 contains the fix

Discovery Timeline

2026-07-08 - CVE CVE-2026-41042 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-41042

Vulnerability Analysis

Apache Gravitino exposes a testConnection API that validates connectivity to a configured database. The endpoint accepts a JDBC URL supplied by the caller and passes it to the underlying driver without restricting the connection string. When Gravitino uses the H2 database engine, the H2 driver honors an INIT parameter embedded in the URL. H2 evaluates the INIT value as SQL executed against the newly opened session, and H2 SQL supports mechanisms that instantiate Java classes and invoke methods. An attacker chains these behaviors to execute arbitrary Java code inside the Gravitino JVM. The testConnection API does not require authentication, so any network-reachable actor can invoke it.

Root Cause

The root cause is improper input validation of the JDBC URL parameter accepted by testConnection. Gravitino did not filter H2-specific query parameters such as INIT, and it did not authenticate callers before parsing the URL. This allowed connection-string injection to reach the H2 driver's code-execution paths.

Attack Vector

An attacker sends an HTTP request to the testConnection endpoint with a JDBC URL of the form jdbc:h2:mem:test;INIT=<attacker SQL>. Gravitino invokes the H2 driver, which opens the in-memory database and executes the INIT payload. The payload triggers Java method invocation, yielding code execution as the Gravitino process user. Gravitino documentation notes that deployments are typically internal and that H2 is not used in production, which reduces exposure but does not eliminate risk in test or lab environments.

The vulnerability manifests in the connection-testing path of the Gravitino API. See the Apache Mailing List Discussion and the Openwall OSS-Security Update for advisory details.

Detection Methods for CVE-2026-41042

Indicators of Compromise

HTTP requests to the Gravitino testConnection API containing jdbc:h2: URLs with an INIT= parameter.
JDBC URLs containing SQL keywords such as CREATE ALIAS, RUNSCRIPT, or CALL embedded in the query string.
Unexpected child processes spawned by the Gravitino JVM, or new outbound network connections initiated from the Gravitino host.

Detection Strategies

Inspect Gravitino application logs for testConnection invocations that reference the H2 driver and log the full JDBC URL for review.
Deploy web application firewall rules that block JDBC URLs containing INIT, RUNSCRIPT, or CREATE ALIAS tokens on public API endpoints.
Correlate JVM process telemetry with API request logs to flag code execution that follows a testConnection call.

Monitoring Recommendations

Enable verbose auditing on the Gravitino REST API and forward logs to a centralized analytics platform.
Monitor Gravitino host processes for anomalous child processes such as sh, bash, cmd.exe, or powershell.exe.
Alert on outbound network connections from the Gravitino service to unexpected destinations, which may indicate post-exploitation activity.

How to Mitigate CVE-2026-41042

Immediate Actions Required

Upgrade Apache Gravitino to version 1.2.1 or later.
Restrict network access to the Gravitino API so only trusted management hosts can reach the testConnection endpoint.
Audit historical API logs for prior testConnection requests that included H2 JDBC URLs with an INIT parameter.

Patch Information

Apache Gravitino 1.2.1 addresses the vulnerability by validating JDBC URLs supplied to the testConnection API. Operators running any release before 1.2.1 should upgrade. Details are available in the Apache Mailing List Discussion.

Workarounds

Do not use the H2 database backend outside of ephemeral testing environments.
Place Gravitino behind an authenticating reverse proxy that blocks anonymous access to the testConnection API.
Filter inbound requests to strip or reject JDBC URL parameters such as INIT, RUNSCRIPT, and CREATE ALIAS at the gateway layer.

bash

# Configuration example: block H2 INIT parameter at an nginx reverse proxy
location /api/metalakes/ {
    if ($request_body ~* "jdbc:h2:.*INIT=") {
        return 403;
    }
    proxy_pass http://gravitino-backend;
}