Vulnerability · Published Jan 5, 2026 · Assigned by apache
CVE-2025-66518Apache Kyuubi: Unauthorized directory access due to missing path normalization
High 8.8
In plain English
A high-severity security flaw in Apache Kyuubi from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.kyuubi:kyuubi-server_2.12 | 1.10.3 | GHSA-f8r6-6222-9pvc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Kyuubi | 1.6.0 – through 1.10.2 |
Weakness: CWE-27 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L