← CVE Intelligence

CVE-2026-41041

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints. PUBLISHED

Description (CNA)

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache Gravitinoaffected 1.0.0 before 1.2.1

CWE

CWE-177

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.