CVE-2025-66518

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.6.0 through 1.10.2

Description A path traversal flaw exists in the Apache Kyuubi server. Clients accessing the server via Kyuubi frontend protocols can bypass the server-side configuration kyuubi.session.local.dir.allow.list, enabling unauthorized access to local files not included in the allowed list. This allows a remote attacker to circumvent security mechanisms and access protected information.

Recommendations Upgrade to version 1.10.3 or later.