Apache Kyuubi (1.7.0 - 1.11.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/apache-kyuubi-1.7.0---1.11.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 04 Aug 2026 13:42:57 +0000Unauthenticated Arbitrary File Write in Apache Kyuubi REST APIhttps://feed.craftedsignal.io/briefs/2026-08-kyuubi-path-traversal/Tue, 04 Aug 2026 13:42:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-kyuubi-path-traversal/An unauthenticated path-traversal vulnerability in the Apache Kyuubi REST API (CVE-2026-52680) allows remote attackers to write arbitrary files to the filesystem, leading to remote code execution.Apache Kyuubi versions 1.7.0 through 1.11.1 contain an unauthenticated arbitrary file write vulnerability (CVE-2026-52680) in the REST API's batch submission endpoint. The flaw exists in the Utils.writeToTempFile method within kyuubi-common, which fails to sanitize the user-supplied filename during multipart form uploads. An attacker can craft a POST request to /api/v1/batches containing a filename with path-traversal sequences (e.g., ../). While the application mangles the basename by appending a suffix, attackers can target directories such as /etc/profile.d/ to drop scripts that are automatically sourced by login shells. This vulnerability is particularly dangerous when Kyuubi is configured with kyuubi.authentication=NONE, which is the default setting. The exploit allows code execution as the user running the Kyuubi process, which could result in full system compromise if Kyuubi is incorrectly running with root privileges.

Attack Chain

  1. Attacker performs reconnaissance to identify Apache Kyuubi REST interfaces reachable on TCP port 10099.
  2. Attacker verifies the target is unauthenticated by sending a GET request to /api/v1/ping.
  3. Attacker constructs a multipart POST request to /api/v1/batches.
  4. The request includes a batchRequest JSON payload and a resourceFile multipart part.
  5. The resourceFile uses a path-traversal filename (e.g., ../../../../../../etc/profile.d/pwn.sh) to escape the target directory.
  6. The Kyuubi process writes the malicious payload to the filesystem (e.g., /etc/profile.d/pwn--.sh).
  7. A user (or scheduled task) initiates a login shell, triggering the system to source the malicious script in /etc/profile.d/.
  8. The payload executes within the context of the user opening the shell, achieving remote code execution.

Impact

The vulnerability allows unauthenticated attackers to achieve remote code execution on the host server. The impact is significant for organizations running Kyuubi in exposed environments, as it enables full server compromise if the Kyuubi process operates with elevated privileges.

Recommendation

  • Upgrade all instances of Apache Kyuubi to version 1.12.0 or later immediately to incorporate proper path normalization.
  • Enable authentication by setting kyuubi.authentication to a secure mechanism (e.g., KERBEROS, LDAP, or PAM) instead of the default NONE.
  • Ensure the Kyuubi service runs with the least privilege possible; never run the service as root.
  • Restrict access to the Kyuubi REST gateway (default port 10099) using network firewalls or VPNs to prevent public or untrusted network exposure.
  • Monitor webserver access logs for anomalous POST requests to /api/v1/batches that contain directory traversal patterns.
]]>criticaladvisory