CVE-2026-41041Disclosure(apache / gravitino)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-177

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gravitino

Threat summary

4 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 3d ago at 1 mentions (2026-07-14); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

apache

Products

gravitino

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	1	Disclosure1
2026-07-20	1	General1
2026-07-21	1	General1
2026-07-25	1	Disclosure1

Full discourse4 posts

Open Source Security mailing list@oss_security92d
Disclosure
Apache Gravitino CVE-2026-41041: URL path injection enabling path traversal to unintended API endpoints https://www.openwall.com/lists/oss-security/2026/07/13/1 CVE-2026-49876: Authenticated SSRF in JobManager https://www.openwall.com/lists/oss-security/2026/07/13/2 Gravitino is a high-performance, geo-distributed, and federated metadata lake
Post summary
Short notice announcing two new CVEs for Apache Gravitino, detailing the types of vulnerabilities and providing links to mailing‑list discussions, but no PoC, exploit, or patch information is included.
00030392
4.7K followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker81d
Disclosure
【緊急】CVE-2026-41041 Apache Gravitinoに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/20/cve-2026-41041-apache-gravitino/ #IT #Security #cybersecurity
Post summary
The post announces a serious vulnerability in Apache Gravitino (CVE-2026-41041) and calls for immediate action, but it provides no technical details, PoC, exploit code, or patch information.
0000031
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker85d
General
【緊急】CVE-2026-41041 Apache Gravitinoに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/20/cve-2026-41041-apache-gravitino/ #IT #Security #cybersecurity
Post summary
The post briefly announces the discovery of CVE‑2026‑41041 in Apache Gravitino but offers no specifics, making it a general notification rather than a detailed disclosure or exploit report.
0000038
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker85d
General
【緊急】CVE-2026-41041 Apache Gravitinoに深刻な脆弱性｜即時対応が必要 #IT #サイバーセキュリティ #cybersecurity https://www.cybernote.click/2026/07/20/cve-2026-41041-apache-gravitino/
Post summary
The tweet alerts that Apache Gravitino has a serious vulnerability (CVE‑2026‑41041) and calls for immediate action, but it provides no technical or actionable details.
0000042
209 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	gravitino	-	-	-

Explore more

Back to dashboard apache CVEs gravitino vulnerabilities

What researchers are saying

CVE-2026-41041

Open Source Security mailing list@oss_securityDisclosure

Short notice announcing two new CVEs for Apache Gravitino, detailing the types of vulnerabilities and providing links to mailing‑list discussions, but no PoC, exploit, or patch information is included.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerDisclosure

The post announces a serious vulnerability in Apache Gravitino (CVE-2026-41041) and calls for immediate action, but it provides no technical details, PoC, exploit code, or patch information.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The post briefly announces the discovery of CVE‑2026‑41041 in Apache Gravitino but offers no specifics, making it a general notification rather than a detailed disclosure or exploit report.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The tweet alerts that Apache Gravitino has a serious vulnerability (CVE‑2026‑41041) and calls for immediate action, but it provides no technical or actionable details.