CVE-2026-41041 PUBLISHED

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

Assigner: apache
Reserved: 16.04.2026 Published: 13.07.2026 Updated: 13.07.2026

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Gravitino
Versions Default: unaffected
  • affected from 1.0.0 to 1.2.1 (excl.)

Credits

  • Andrea Cosentino (ancosen@gmail.com) reporter

References

Problem Types

  • CWE-177 Improper Handling of URL Encoding (Hex Encoding) CWE