CVE-2026-23904

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23904", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-19T03:40:46.158Z", "datePublished": "2026-07-29T09:07:18.168Z", "dateUpdated": "2026-07-29T14:00:38.959Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kyuubi:kyuubi-server", "product": "Apache Kyuubi", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "1.8.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "\u00cdcaro Torres"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\">Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.&nbsp;</span></span><span style=\"background-color: rgb(255, 255, 255);\">A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.</span><br></p><p>This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which disables the proxy by default.&nbsp;To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.</p>"}], "value": "Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.\u00a0A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.\n\n\nThis issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which disables the proxy by default.\u00a0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-29T09:07:18.168Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/kyuubi/pull/7483"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/ps79fcfx49ox9kwgztc5t5bw0tyhck9m"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/29/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-29T09:58:41.805Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T14:00:33.613216Z", "id": "CVE-2026-23904", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:00:38.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/29/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-29T09:58:41.805Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23904", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:00:33.613216Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:00:18.202Z"}}], "cna": {"title": "Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "\u00cdcaro Torres"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kyuubi", "versions": [{"status": "affected", "version": "1.8.0", "lessThan": "1.12.0", "versionType": "semver"}], "packageName": "org.apache.kyuubi:kyuubi-server", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/kyuubi/pull/7483", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/ps79fcfx49ox9kwgztc5t5bw0tyhck9m", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.\u00a0A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.\n\n\nThis issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which disables the proxy by default.\u00a0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.", "supportingMedia": [{"type": "text/html", "value": "<p><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\">Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.&nbsp;</span></span><span style=\"background-color: rgb(255, 255, 255);\">A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.</span><br></p><p>This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which disables the proxy by default.&nbsp;To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-29T09:07:18.168Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23904", "state": "PUBLISHED", "dateUpdated": "2026-07-29T14:00:38.959Z", "dateReserved": "2026-01-19T03:40:46.158Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-07-29T09:07:18.168Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kyuubi:kyuubi-server", "product": "Apache Kyuubi", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "1.8.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:kyuubi:*:*:*:*:*:*:*:*", "matchCriteriaId": "C91B47BA-EB31-4B09-B743-BCA028DB4855", "versionEndExcluding": "1.12.0", "versionStartIncluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.\u00a0A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.\n\n\nThis issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which disables the proxy by default.\u00a0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts."}, {"lang": "es", "value": "El proxy de la interfaz de usuario de Kyuubi Engine acepta un host y un puerto de la ruta de la solicitud y act\u00faa como proxy para las solicitudes HTTP a ese destino. Un solicitante remoto con acceso de red al proxy puede hacer que el servidor Kyuubi env\u00ede solicitudes HTTP a hosts arbitrarios accesibles, lo que resulta en SSRF o comportamiento de proxy abierto.\n\nEste problema afecta a Apache Kyuubi: desde la versi\u00f3n 1.8.0 hasta antes de la 1.12.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.12.0, que deshabilita el proxy por defecto. Para restaurar la interfaz de usuario de Engine con proxy, establezca kyuubi.frontend.rest.engine.ui.proxy.enabled=true y configure los hosts de destino permitidos con kyuubi.frontend.rest.engine.ui.proxy.hosts."}], "id": "CVE-2026-23904", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23904", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T14:00:33.613216Z", "version": "2.0.3"}}]}, "published": "2026-07-29T10:16:40.913", "references": [{"source": "security@apache.org", "tags": ["Patch"], "url": "https://github.com/apache/kyuubi/pull/7483"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/ps79fcfx49ox9kwgztc5t5bw0tyhck9m"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/29/3"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-923"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.8.0,1.12.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Kyuubi", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kyuubi", "vendor": "apache"}], "created": "2026-07-29T11:00:12.857832+00:00", "updated": "2026-08-03T13:45:03.134506+00:00", "vendors": ["apache", "apache$PRODUCT$kyuubi"]}