{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23904", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-19T03:40:46.158Z", "datePublished": "2026-07-29T09:07:18.168Z", "dateUpdated": "2026-07-29T14:00:38.959Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kyuubi:kyuubi-server", "product": "Apache Kyuubi", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "1.8.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "\u00cdcaro Torres"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\">Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.&nbsp;</span></span><span style=\"background-color: rgb(255, 255, 255);\">A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.</span><br></p><p>This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which disables the proxy by default.&nbsp;To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.</p>"}], "value": "Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.\u00a0A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.\n\n\nThis issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which disables the proxy by default.\u00a0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-29T09:07:18.168Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/kyuubi/pull/7483"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/ps79fcfx49ox9kwgztc5t5bw0tyhck9m"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/29/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-29T09:58:41.805Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T14:00:33.613216Z", "id": "CVE-2026-23904", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:00:38.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/29/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-29T09:58:41.805Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23904", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:00:33.613216Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:00:18.202Z"}}], "cna": {"title": "Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "\u00cdcaro Torres"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kyuubi", "versions": [{"status": "affected", "version": "1.8.0", "lessThan": "1.12.0", "versionType": "semver"}], "packageName": "org.apache.kyuubi:kyuubi-server", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/kyuubi/pull/7483", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/ps79fcfx49ox9kwgztc5t5bw0tyhck9m", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.\u00a0A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.\n\n\nThis issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which disables the proxy by default.\u00a0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.", "supportingMedia": [{"type": "text/html", "value": "<p><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\">Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.&nbsp;</span></span><span style=\"background-color: rgb(255, 255, 255);\">A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.</span><br></p><p>This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which disables the proxy by default.&nbsp;To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-29T09:07:18.168Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23904", "state": "PUBLISHED", "dateUpdated": "2026-07-29T14:00:38.959Z", "dateReserved": "2026-01-19T03:40:46.158Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-07-29T09:07:18.168Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.8.0,1.12.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Kyuubi", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kyuubi", "vendor": "apache"}], "created": "2026-07-29T11:00:12.857832+00:00", "updated": "2026-07-29T11:00:12.858281+00:00", "vendors": ["apache", "apache$PRODUCT$kyuubi"]}