Product
Apache Gravitino versions 1.0.0 through 1.2.1 contain an authenticated SSRF vulnerability (CVE-2026-49876) allowing attackers to perform internal network reconnaissance or access metadata services.