Intel

CVE-2026-41042

Unauthentifizierte Aufrufer können über die testConnection-API einen bösartigen H2 JDBC-URL bereitstellen, der über den INIT-Parameter vo…

criticalPoCEPSS 1.5%

Description

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Source: NVD (NIST)cvelistv5

Metrics

XIEM Effective CVSS
9.1
Source: nvd-v3
EPSS percentile
73.7 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
110.66
Exploit maturity
PoC (publicly reported)
CVSS v3
9.1
EPSS score
1.5 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2026-07-08 11:38 UTC
CWE
CWE-20

Weakness classes (CWE)

  • CWE-20Class

    Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

    cwe.mitre.org →

References & sources

Linked advisories