CVE-2026-49876: Apache Gravitino SSRF Vulnerability

CVE-2026-49876 Overview

CVE-2026-49876 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Apache Gravitino JobManager component. The flaw allows authenticated users to submit job templates containing unvalidated Uniform Resource Identifiers (URIs). Gravitino then issues server-side HTTP requests to those destinations, including internal network hosts and cloud provider metadata endpoints.

The issue affects Apache Gravitino versions 1.0.0 through 1.2.1 and is fixed in version 1.3.0. The vulnerability is tracked as [CWE-918] Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot to internal services and exfiltrate cloud metadata credentials from AWS, Azure, or GCP instance metadata services.

Affected Products

Apache Gravitino 1.0.0 through 1.2.1
Apache Gravitino JobManager component
Deployments on AWS, Azure, and GCP exposing instance metadata endpoints

Discovery Timeline

2026-07-13 - CVE-2026-49876 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-49876

Vulnerability Analysis

Apache Gravitino is a metadata lake platform that exposes a JobManager service for scheduling and executing job templates. The JobManager accepts job specifications containing URI fields that reference remote resources such as scripts, dependencies, or configuration files.

The JobManager fetches these URIs on the server side without validating the destination host, scheme, or IP address. An authenticated user with permission to submit jobs can supply arbitrary URIs pointing to internal infrastructure. Gravitino's backend then performs HTTP requests on the attacker's behalf.

Because the request originates from the Gravitino host, it bypasses network segmentation that would block external clients. Sensitive targets include cloud instance metadata services at 169.254.169.254, internal admin panels, Kubernetes API servers, and Redis or Elasticsearch endpoints bound to loopback interfaces.

Root Cause

The root cause is missing URI validation and destination allowlisting in the job template ingestion path. The JobManager treats user-supplied URIs as trusted resource locations. There is no filter preventing private IP ranges (RFC 1918), link-local addresses, or metadata service hostnames.

Attack Vector

Exploitation requires valid Gravitino credentials with job submission privileges. The attacker crafts a job template with a URI field targeting an internal endpoint, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. When Gravitino processes the job, it issues the outbound request and may return the response body or error details to the attacker. The technique is standard SSRF and can be adapted to fingerprint internal networks, retrieve short-lived cloud credentials, or interact with unauthenticated internal APIs.

No verified public proof-of-concept is available at this time. See the Apache Security Discussion Thread for advisory details.

Detection Methods for CVE-2026-49876

Indicators of Compromise

Outbound HTTP requests from the Gravitino host to 169.254.169.254, metadata.google.internal, or 169.254.169.254/metadata/instance (Azure)
Job templates in Gravitino audit logs containing URIs referencing RFC 1918 private addresses or localhost
Unexpected access patterns to internal services originating from the Gravitino service account

Detection Strategies

Enable verbose audit logging on the Gravitino JobManager and inspect submitted job template URIs for private, loopback, and link-local destinations
Correlate Gravitino process network telemetry with cloud metadata endpoint access using an Endpoint Detection and Response (EDR) or Network Detection and Response (NDR) tool
Alert on any job submission where the URI scheme is not on an explicit allowlist (for example, only https:// to approved artifact repositories)

Monitoring Recommendations

Monitor egress connections from the Gravitino host and flag destinations in 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16
Track authentication events for Gravitino accounts with job submission roles and investigate anomalous submission volumes
Ingest Gravitino application logs into a centralized Security Information and Event Management (SIEM) platform for URI pattern analysis

How to Mitigate CVE-2026-49876

Immediate Actions Required

Upgrade Apache Gravitino to version 1.3.0 or later, which contains the official fix
Audit all Gravitino user accounts with job submission privileges and revoke unnecessary access
Review historical job template submissions for URIs targeting internal or metadata endpoints

Patch Information

Apache has released Apache Gravitino 1.3.0 to remediate CVE-2026-49876. The fix introduces URI validation in the JobManager ingestion path. Refer to the Apache Security Discussion Thread and the Openwall OSS-Security Post for release details.

Workarounds

Restrict Gravitino egress traffic at the network layer using security groups or firewall rules that block access to 169.254.169.254 and internal service subnets
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS instances hosting Gravitino to require session tokens for metadata access
Limit job submission privileges to a minimum set of trusted service accounts until upgrade is complete
Deploy Gravitino behind an egress proxy that enforces an allowlist of approved outbound destinations

bash

# Configuration example: iptables egress restriction blocking cloud metadata
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 169.254.170.2 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 6443 -j DROP