Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-49876 EUVD-2026-43323GHSA-q28r-579j-9qxqPYSEC-2026-3442

Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs

Published Jul 13, 2026 · Updated Jul 13, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Gravitino Package: apache-gravitino Ecosystem: PyPI

Description

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 through 1.2.1.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Gravitino 1.0.0 – ≤ 1.2.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-gravitino >= 1.0.0, < 1.3.0 1.3.0 PYSEC-2026-3442

References