CVE-2026-41042

CriticalCVSS 9.1/10Last modified Oct 25, 2026

Description

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-410436.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An aut CVE-2026-410448.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broke CVE-2026-410457.0A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentic CVE-2026-410467.3A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious confi CVE-2026-410475.5Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise r CVE-2026-410487.1Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functi CVE-2026-410497.1Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to CVE-2026-41056.7A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation o CVE-2026-410509.9Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-CVE-2026-410515.0csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.CVE-2026-410528.8Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2 CVE-2026-410538.8Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principa