CVE-2026-49876

MEDIUM 6.5CVE-2026-49876 · PYSEC-2026-3442 · Published 13/07/2026 · updated 24/10/2026

In short

CVE-2026-49876 is a MEDIUM (CVSS 6.5) vulnerability affecting apache-gravitino, gravitino (apache).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.3% of all vulnerabilities.
Fix: update to 1.3.0 or later.

Package	Affected versions	Patched versions
apache-gravitino PyPI	`≥ 1.0.0, < 1.3.0`	`1.3.0`
gravitino apache	`≥ 1.0.0, < 1.3.0`	`1.3.0`

Description

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 through 1.2.1.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

References

openwall.com/lists/oss-security/2026/07/13/2 · ADVISORY
lists.apache.org/thread/2ffkj771d6dp1okh2cdtody969hoo1zs · ADVISORY

More vulnerabilities in apache-gravitino

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-gravitino

PyPI

≥ 1.0.0, < 1.3.0

1.3.0

gravitino

apache

≥ 1.0.0, < 1.3.0

1.3.0

Description

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 through 1.2.1.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description