CVE-2026-92287
Received Received - Intake

KMS URL Spoofing in Apache Parquet and PyArrow

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious host set by an attacker in the file.  Users are recommended to upgrade to version 26.0.0, which disables this behavior by default and requires that users opt-in to it by enabling the read_kms_url flag in the DecryptionConfiguration. Users of affected versions are recommended to either specify the KMS URL in the KmsConnectionConfig when reading files, or ensure any KmsClient implementations validate received KMS URLs. Users that opt-in to file-controlled KMS URLs in version 26.0.0 and later must ensure KmsClients validate KMS URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-92287
EUVD
EUVD-2026-104836

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Arrow C++ 4.0.0
Apache Software Foundation PyArrow 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves unvalidated KMS URLs being passed through from Parquet files to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. Attackers can craft malicious Parquet files with KMS URLs pointing to their own servers. If the KMS client does not validate these URLs, sensitive tokens may be sent to the attacker's host.

Impact Analysis

If you read Parquet files with KMS decryption enabled, an attacker could trick your system into sending sensitive KMS access tokens to their server. This could lead to unauthorized access to encrypted data or cloud resources if the tokens are valid.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must ensure proper validation of KMS URLs to maintain compliance.

Mitigation Strategies

Upgrade to Apache Arrow version 26.0.0 or later. If using affected versions, either specify the KMS URL in KmsConnectionConfig when reading files or ensure KmsClient implementations validate received KMS URLs. Disable file-controlled KMS URLs unless explicitly required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart