CyberRota Analysis
AI-GeneratedApache Gravitino versions prior to 1.2.1 are vulnerable to a critical URL path injection flaw due to unencoded user-supplied identifiers. Exploitation of this vulnerability could allow attackers to manipulate URLs, potentially leading to unauthorized access or data exposure. Organizations using affected versions should prioritize upgrading to 1.2.1 to mitigate this risk.
CVE
CVE-2026-41041
Severity
CRITICAL
CVSS
9.1
EPSS
0.47%
Apache
Original NVD Description
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)