{
  "from_raw": "Akira Ajisaka <aajisaka@apache.org>",
  "from": "Akira Ajisaka <aa...@apache.org>",
  "gravatar": "b1835b72f50e06c231765827942b281e",
  "to": "an...@apache.org,\n de...@kyuubi.apache.org",
  "subject": "CVE-2026-23904: Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy",
  "message-id": "<5467f2b0-bb2c-c1f4-5351-67772a2b819e@apache.org>",
  "mid": "458bxctjgqt4v97zhbrrbkwgcztj61zy",
  "permalinks": [
    "458bxctjgqt4v97zhbrrbkwgcztj61zy",
    "rbd174bf448460f10002066e3cdb042867d7687da72f71102e6d17004@<announce.apache.org>"
  ],
  "dbid": "5eab812b68d9077f8b2f791962a5337efb4eeadf70cbb57c86f9ff65510fd600",
  "cc": "de...@kyuubi.apache.org",
  "epoch": 1785297605,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/07/29 04:00:05",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: moderate \n\nAffected versions:\n\n- Apache Kyuubi (org.apache.kyuubi:kyuubi-server) 1.8.0 before 1.12.0\n\nDescription:\n\nKyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination.\u00a0A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior.\n\n\nThis issue affects Apache Kyuubi: from 1.8.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which disables the proxy by default.\u00a0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.\n\nCredit:\n\n\u00cdcaro Torres (reporter)\n\nReferences:\n\nhttps://github.com/apache/kyuubi/pull/7483\nhttps://kyuubi.apache.org\nhttps://www.cve.org/CVERecord?id=CVE-2026-23904\n\n",
  "body_short": "Severity: moderate \n\nAffected versions:\n\n- Apache Kyuubi (org.apache.kyuubi:kyuubi-server) 1.8.0 before 1.12.0\n\nDescription:\n\nKyuubi Engine UI proxy accepts a host and port from the request path and pr",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 2790,
  "id": "458bxctjgqt4v97zhbrrbkwgcztj61zy"
}