CVE-2026-92287 Apache Software Foundation CVE debrief

Who should care

Apache Arrow C++ and PyArrow users reading Parquet files with decryption properties should assess exposure and verify KMS URL validation in KmsClient implementations. This includes users who configure Parquet decryption properties with a KmsClient implementation and are potentially exposed to KMS token exposure. Users should review their configurations and ensure that KmsClient implementations validate received KMS URLs to prevent potential KMS token

Why it matters

Apache Arrow C++ and PyArrow users reading Parquet files with decryption properties should verify KMS URL validation in KmsClient implementations to prevent potential KMS token exposure.

• Potential KMS token exposure via unvalidated KMS URLs.
• Need to verify KMS URL validation in KmsClient implementations.
• Upgrade to version 26.0.0 or later to disable vulnerable behavior by default.
• Specify KMS URLs in KmsConnectionConfig for application control.

Technical summary

Apache Arrow C++ and PyArrow versions 4.0.0 to 25.0.1 pass through unvalidated KMS URLs to KMS clients, potentially allowing KMS token exposure. The vulnerability is addressed in version 26.0.0, which disables this behavior by default. Users of affected versions are recommended to either specify the KMS URL in the KmsConnectionConfig when reading files or ensure any KmsClient implementations validate received KMS URLs. This vulnerability affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation.

Defensive priority

Medium

Recommended defensive actions

• Verify KMS URL validation in KmsClient implementations for Apache Arrow C++ and PyArrow versions 4.0.0 to 25.0.1.
• Upgrade to Apache Arrow C++ and PyArrow version 26.0.0 or later, which disables the vulnerable behavior by default.
• Specify KMS URLs in KmsConnectionConfig when reading files to ensure application control.
• Ensure KmsClient implementations validate received KMS URLs to prevent potential KMS token exposure.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in Apache Arrow C++ and PyArrow versions 4.0.0 to 25.0.1, where a file-controlled KMS URL is forwarded to a pluggable KmsClient that skips host validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.