Unvalidated KMS URL Handling in Apache C++ Parquet and PyArrow

CVE-2026-92287

What is CVE-2026-92287?

The vulnerability arises from the pass-through of unvalidated Key Management Service (KMS) URLs to KMS clients in specific versions of Apache C++ Parquet and PyArrow. This flaw can compromise data security when reading Parquet files with configured decryption properties using an insecure KmsClient implementation. If not controlled by the application, a file-controlled KMS URL can be forwarded to an unsafe KmsClient, potentially allowing attackers to capture KMS tokens sent to malicious hosts. To mitigate this risk, users are advised to upgrade to version 26.0.0, which disables this behavior by default. Furthermore, users should specify KMS URLs directly in KmsConnectionConfig or ensure proper validation in KmsClient implementations.

References