Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-41041 EUVD-2026-43324GHSA-p87c-hmgx-wg42PYSEC-2026-3441

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

Published Jul 13, 2026 · Updated Jul 13, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Gravitino Package: apache-gravitino Ecosystem: PyPI

Description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Gravitino 1.0.0 – < 1.2.1 1.2.1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-gravitino >= 1.0.0, < 1.2.1 1.2.1 PYSEC-2026-3441

References