High [CVE-2026-23904] Apache Kyuubi: Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination
This high-severity Apache Software Foundation advisory covers CVE-2026-23904 affecting Apache Kyuubi.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.
This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.
Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.
- 1.8.0 through 1.12.0.
Official advisory · high-confidence parse· fetched 3 months ago·verify at source
- 1.12.0
Official advisory · high-confidence parse· fetched 3 months ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 1.12.0, which disables the proxy by default.
- To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.
Official advisory · high-confidence parse· fetched 3 months ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-71569Oct 29, 2026Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local
- CVE-2026-115942Oct 29, 2026Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer
- CVE-2026-114230Oct 29, 2026Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent
- CVE-2026-105042Oct 29, 2026Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
- CVE-2026-105031Oct 29, 2026Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate
- CVE-2026-114349Oct 28, 2026Apache Kafka: When a broker decodes a compressed record batch, the per-record decoder
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.