Server-side configuration bypass in Apache Kyuubi by Spark config aliases

CVE-2026-62391

What is CVE-2026-62391?

A security flaw in Apache Kyuubi allows attackers to bypass the server-side configuration related to 'kyuubi.session.local.dir.allowlist'. This vulnerability is caused by incomplete mitigation for a previous known issue, allowing any client with access to the Apache Kyuubi Server through the Kyuubi frontend protocols to exploit unprefixed Spark configuration aliases. Users are strongly advised to upgrade to version 1.12.0 to address this security concern.

References