CVE-2026-41041

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

State: Published
Severity: 9.1 Critical
Published: Jul 13, 2026
Updated: Jul 13, 2026
Reserved: Apr 16, 2026

Read the record on cve.org

Description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-177 Improper Handling of URL Encoding (Hex Encoding)

Affected Products

Product	Versions
Apache GravitinoApache Software Foundation	1.0.0 to before 1.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.