SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-23904

HIGH · CVSS 7.3 EPSS 0.52% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-29 · Last synced 2026-08-28

CyberRota Analysis

AI-Generated

The Apache Kyuubi Engine UI proxy is vulnerable to Server-Side Request Forgery (SSRF) and open-proxy behavior, allowing remote attackers with network access to send HTTP requests to arbitrary hosts. This could lead to unauthorized access to internal services and data exposure. Organizations using affected versions (1.8.0 to 1.11.9) should prioritize upgrading to version 1.12.0, which disables the proxy by default, to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-23904
Severity
HIGH
CVSS
7.3
EPSS
0.52%
Apache

Original NVD Description

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.

Related CVEs

Other vulnerabilities affecting the same vendor(s)