CVE-2026-41042 Code injection in Apache Gravitino
Unauthenticated attackers can execute arbitrary Java code on Apache Gravitino servers by supplying a malicious H2 JDBC URL to the testConnection API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41042?
CVE-2026-41042 is a critical code injection vulnerability in Apache Gravitino, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: before 1.2.1.
Users are recommended to upgrade to version 1.2.1, which fixes the issue.
This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.
Weakness: CWE-20
Which versions are affected by CVE-2026-41042?
How do I fix CVE-2026-41042?
No fix has been published for CVE-2026-41042 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41042 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-2q68-xwfj-2rpc.