How severe is CVE-2026-41041?

CVE-2026-41041 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-41041 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-41041?

CVE-2026-41041 affects Apache Gravitino. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-41041?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-41041 published?

CVE-2026-41041 was published on 2026-07-13.

CVE-2026-41041

CVE-2026-41041 is a critical-severity vulnerability in Apache Gravitino with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-177.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 0% (39th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-177
Affected product: Apache Gravitino
Published: 2026-07-13
Last modified: 2026-07-13

Description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Frequently asked questions

What is CVE-2026-41041?: URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.
How severe is CVE-2026-41041?: CVE-2026-41041 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-41041 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-41041?: CVE-2026-41041 affects Apache Gravitino. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-41041?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-41041 published?: CVE-2026-41041 was published on 2026-07-13.

References

Affected products (1)

cpe:2.3:a:apache:gravitino:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Gravitino

CVE-2026-49876 — Medium (CVSS 6.5): Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata…
CVE-2025-53648 — Medium (CVSS 5.4): SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate…

All CVEs affecting Apache Gravitino →

Other CWE-177 vulnerabilities

CVE-2026-59083 — Critical (CVSS 9.1): Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security…
CVE-2026-22037 — High (CVSS 8.4): The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in…
CVE-2026-22031 — High (CVSS 8.4): @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in…
CVE-2026-15371 — High (CVSS 8.1): Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and…
CVE-2026-29045 — High (CVSS 7.5): Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when…
CVE-2026-67448 — Medium (CVSS 6.5): Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin…

Browse all CWE-177 vulnerabilities →