CVE-2026-41042 Scanner
CVE-2026-41042 Scanner - Remote Code Execution (RCE) vulnerability in Apache Gravitino
Used 2.3k times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-41042
9.1
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
apache gravitino
Updated Nov 6, 2026View on NVD →
S4E scanner
CVE history: apache gravitino
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →