CVE-2026-62391 Overview
CVE-2026-62391 is an incomplete-fix vulnerability in Apache Kyuubi. The original patch for CVE-2025-66518 failed to close all bypass paths for the kyuubi.session.local.dir.allowlist server-side configuration control. Any client with access to the Apache Kyuubi Server through Kyuubi frontend protocols can bypass the allowlist by supplying unprefixed Spark configuration aliases. The flaw affects Apache Kyuubi from version 1.6.0 up to but not including 1.12.0. Apache classifies this as a path traversal weakness [CWE-22], enabling unauthorized access to local directories outside the intended allowlist scope.
Critical Impact
Authenticated clients can bypass server-side directory allowlist enforcement and access arbitrary local paths on the Kyuubi Server, compromising confidentiality and integrity of hosted data.
Affected Products
- Apache Kyuubi 1.6.0 through 1.11.x
- Apache Kyuubi deployments exposing Kyuubi frontend protocols to clients
- Apache Kyuubi configurations relying on kyuubi.session.local.dir.allowlist for isolation
Discovery Timeline
- 2026-07-31 - CVE-2026-62391 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-62391
Vulnerability Analysis
Apache Kyuubi is a distributed multi-tenant gateway that provides serverless SQL access on data warehouses and lakehouses. The kyuubi.session.local.dir.allowlist server-side setting restricts which local directories a client session may reference for staging or file operations. The initial fix for CVE-2025-66518 filtered known Spark configuration keys used to override these directories. That filter missed unprefixed Spark configuration aliases, which resolve to the same underlying properties inside the Spark engine.
An authenticated client can submit an alias that circumvents the allowlist check while still directing Kyuubi to use a path outside the approved set. The impact aligns with a path traversal weakness [CWE-22], allowing read and write access to directories the operator intended to keep off-limits.
Root Cause
The root cause is incomplete input validation over the full namespace of Spark configuration keys. The Kyuubi allowlist enforcement logic normalized only prefixed Spark configuration names when comparing user-supplied session parameters against the allowlist. Unprefixed aliases bypassed the normalization step and reached the engine unchecked, defeating the security control.
Attack Vector
The vulnerability is exploitable over the network by any client that can authenticate to a Kyuubi frontend protocol endpoint. The attacker submits session configuration parameters using unprefixed Spark alias names that map to local directory settings. Kyuubi accepts the aliases without matching them against kyuubi.session.local.dir.allowlist, and the resulting session operates against attacker-selected paths on the server.
No public proof-of-concept exploit is currently listed for CVE-2026-62391. Technical details are described in the Apache Mailing List Thread.
Detection Methods for CVE-2026-62391
Indicators of Compromise
- Session creation requests that include unprefixed Spark configuration aliases referencing local directory keys.
- Kyuubi server logs showing local directory paths outside the configured kyuubi.session.local.dir.allowlist values.
- Engine processes reading or writing to filesystem locations not previously used by legitimate workloads.
Detection Strategies
- Audit Kyuubi frontend session parameters for Spark configuration keys that resolve to directory settings but lack the expected spark. prefix normalization.
- Correlate session identifiers with filesystem access telemetry to identify sessions touching paths outside the allowlist.
- Compare Kyuubi server version strings against the fixed release 1.12.0 during asset inventory scans.
Monitoring Recommendations
- Enable verbose logging on the Kyuubi Server for session configuration overrides and forward events to a centralized SIEM.
- Monitor operating system file access events on the Kyuubi host for reads or writes originating from Kyuubi engine processes outside expected working directories.
- Alert on new or unusual authenticated clients establishing Kyuubi sessions during off-hours or from atypical source addresses.
How to Mitigate CVE-2026-62391
Immediate Actions Required
- Upgrade Apache Kyuubi to version 1.12.0 or later, which contains the complete fix.
- Restrict network access to Kyuubi frontend protocol ports so that only trusted client networks can reach the server.
- Review authentication and authorization configuration to ensure only vetted users hold Kyuubi session privileges.
- Rotate credentials for any accounts whose sessions cannot be audited against the allowlist between the vulnerability window and the upgrade.
Patch Information
Apache Kyuubi version 1.12.0 resolves CVE-2026-62391 by extending allowlist enforcement to cover unprefixed Spark configuration aliases. Operators running any release from 1.6.0 through 1.11.x must upgrade. Refer to the Apache Mailing List Thread for the vendor advisory.
Workarounds
- Place Kyuubi Servers behind network segmentation that limits client access to a small, trusted set of source hosts.
- Reduce filesystem exposure on the Kyuubi host by tightening operating system permissions on directories that must not be accessed by engine processes.
- Disable Kyuubi frontend protocols that are not required by production workloads until the upgrade is applied.
# Configuration example: verify installed Kyuubi version and enforce fixed release
bin/kyuubi --version
# Expected output must be 1.12.0 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
