Apache Gravitino vulnerabilities

3 CVEs affecting Apache Gravitino, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49876, published 2026-07-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-41041, published 2026-07-13. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to…
CVE-2025-53648, published 2026-06-30. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade to version 1.0.0, which fixes this issue.
CVE-2026-49876, published 2026-07-13. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache…