p PatchFirst

CVE-2026-49876

CVE-2026-49876 · Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache gravitino

    Versions
    • ≥ 1.0.0, ≤ 1.2.1: Affected (semver)

    No fix published

  • apache-gravitino PyPI

    Versions
    • 1.0.0
    • 1.0.1
    • 1.0.1rc1
    • 1.0.1rc2
    • 1.1.0
    • 1.1.0rc0
    • 1.1.0rc1
    • 1.1.0rc2
    • 1.1.0rc3
    • 1.1.0rc4
    • 1.1.1
    • 1.1.1rc1
    • 1.1.1rc3
    • 1.1.1rc4
    • 1.2.0
    • 1.2.0.dev0
    • 1.2.0rc1
    • 1.2.0rc10
    • 1.2.0rc11
    • 1.2.0rc2
    • 1.2.0rc4
    • 1.2.0rc5
    • 1.2.0rc6
    • 1.2.0rc7
    • 1.2.0rc8
    • 1.2.0rc9
    • 1.2.1
    • 1.2.1rc1
    • 1.2.1rc2
    • 1.3.0rc1
    • 1.3.0rc2
    • 1.3.0rc3
    • 1.3.0rc4
    • 1.3.0rc5
    • 1.3.0rc6
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.3.0

    Update to 1.3.0

Original sources

Check your server →