High · published January 5, 2026
⚡ A crafty oversight lets anyone with access to Apache Kyuubi Server access local files not meant for them—like a guest rifling through a locked cabinet! 🔓 Think of it as having a hotel key that allows you to enter rooms that should be off-limits. Instead of just accessing your own room, you could waltz into any unlocked space, snooping around without restriction. This vulnerability means that an unauthorized client could exploit the Apache Kyuubi Server to access sensitive local files that aren't explicitly listed in the server configuration. Imagine the chaos if a guest could rummage through confidential documents instead of just their own! This could lead to data leaks or compromised information, which is absolutely devastating for any organization.
Think of it as having a hotel key that allows you to enter rooms that should be off-limits. Instead of just accessing your own room, you could waltz into any unlocked space, snooping around without restriction. This issue allows clients to bypass the server-side configuration setting `kyuubi.session.local.dir.allow.list`, enabling them to use local files that aren't meant to be accessible. Basically, the server is too trusting in allowing access to files it shouldn't.
This vulnerability means that an unauthorized client could exploit the Apache Kyuubi Server to access sensitive local files that aren't explicitly listed in the server configuration. Imagine the chaos if a guest could rummage through confidential documents instead of just their own! This could lead to data leaks or compromised information, which is absolutely devastating for any organization. Upgrade your Apache Kyuubi installation from any version between 1.6.0 and 1.10.2 to version 1.10.3 or higher to resolve this vulnerability. Additionally, review your server settings to ensure no other configurations might be overly permissive. You've got this! Patching your system will put you back in control and keep your data safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/kyuubi | ≥ 1.6.0, < 1.10.3 | 1.10.3 |