CVE-2026-41041 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-41041 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-41041 is a URL path injection vulnerability in Apache Gravitino, a metadata lake platform, caused by unencoded user-supplied identifiers being incorporated directly into URL paths without proper sanitization.

Technical Detail

The flaw exists in Apache Gravitino versions 1.0.0 through 1.2.0, where user-controlled input such as catalog, schema, or table identifiers is passed into URL path construction without encoding or validation. An attacker who can supply crafted identifier strings containing path traversal sequences or special characters may manipulate the resulting URL path, potentially redirecting requests to unintended API endpoints or backend resources. Depending on how downstream components process the injected path, this could result in unauthorized access to data, privilege escalation within the metadata service, or server-side request forgery conditions.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. There is no public proof-of-concept code or active exploitation reporting as of July 20, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. The reported actor entries in available data reflect source labels such as CERT and CISA KEV references rather than actual attributed actors, and no confirmed or research-inferred threat actor has been linked to exploitation of this vulnerability. No campaigns targeting this CVE have been identified.

What To Do

Organizations running Apache Gravitino should upgrade to version 1.2.1 or later, which is the vendor-recommended remediation. Given the CVSS score of 9.1 and the nature of the injection class, patching should be treated as high priority even in the absence of known active exploitation. If immediate patching is not feasible, restrict network access to the Gravitino API surface to trusted internal hosts only, and audit identifier inputs at any ingestion or API gateway layer for anomalous path characters such as encoded slashes, dot sequences, or percent-encoded special characters. Monitor API access logs for unexpected path patterns that deviate from standard identifier formats.