CVE-2026-23904

Analyzed Analyzed - Analysis Complete

Server-Side Request Forgery in Apache Kyuubi Engine UI Proxy

Publication date: 2026-07-29

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-05

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-23904

Affected Vendors & Products

Vendor	Product	Version / Range
apache	kyuubi	From 1.8.0 (inc) to 1.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-923	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

Executive Summary

This vulnerability allows a remote attacker with network access to the Kyuubi Engine UI proxy to send HTTP requests to arbitrary hosts. This can result in Server-Side Request Forgery (SSRF) or open-proxy behavior, where the proxy forwards requests to unintended destinations.

Detection Guidance

To detect this vulnerability, check if your Kyuubi server is running a version between 1.8.0 and 1.11.x. Verify if the proxy feature is enabled by inspecting configuration files for kyuubi.frontend.rest.engine.ui.proxy.enabled=true. Monitor network traffic for unexpected outbound HTTP requests from the Kyuubi server to arbitrary hosts.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate data, or perform unauthorized actions on behalf of the proxy. It may also allow bypassing network restrictions or launching further attacks from the proxy server.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if sensitive data is exposed through SSRF attacks.

Mitigation Strategies

Upgrade Kyuubi to version 1.12.0 or later where the proxy is disabled by default. If upgrading is not possible, disable the proxy by setting kyuubi.frontend.rest.engine.ui.proxy.enabled=false in configuration files. Restrict network access to the Kyuubi server to prevent unauthorized requests.

Hi! I’m here to help you understand CVE-2026-23904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70