CVE-2026-41041

CRITICAL 9.1CVE-2026-41041 · PYSEC-2026-3441 · Published 13/07/2026 · updated 24/10/2026

In short

CVE-2026-41041 is a CRITICAL (CVSS 9.1) vulnerability affecting apache-gravitino, gravitino (apache).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.6% of all vulnerabilities.
Fix: update to 1.2.1 or later.

Package	Affected versions	Patched versions
apache-gravitino PyPI	`≥ 1.0.0, < 1.2.1`	`1.2.1`
gravitino apache	`≥ 1.0.0, < 1.2.1`	`1.2.1`

Description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.

NVD description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

References

openwall.com/lists/oss-security/2026/07/13/1 · ADVISORY
lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz · ADVISORY

More vulnerabilities in apache-gravitino

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free