Vulnerability record · CVE-2026-41041 · published 13 July 2026

CVE-2026-41041: Apache gravitino vulnerability

Apache · Gravitino

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

9.1 CVSS 3.1 Critical EPSS 0.60% · top 53.6% CWE-177 · CWE-177

9.1CVSS 3.1 base score

0.60%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

13 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Gravitino Apache

References

Link	Tags
https://lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz	Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/13/1	Mailing ListThird Party Advisory

Track CVE-2026-41041 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2026-49876Apache gravitino server-side request forgery (ssrf) vulnerabilityAuthenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job temp…EPSS 0.49%13 Jul 2026 5.4CVE-2025-53648Apache gravitino sql injection vulnerabilitySQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to…EPSS 0.56%30 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2026-41041), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.