CVE-2025-66518 Apache CVE debrief

Who should care

System administrators and security teams responsible for Apache Kyuubi Server instances should assess exposure and prioritize patching to prevent unauthorized access to local files.

Why it matters

CVE-2025-66518 is a high-severity vulnerability in Apache Kyuubi Server that allows clients to bypass server-side config and access local files not listed in the config. System administrators and security teams should assess exposure and prioritize patching to prevent unauthorized access. The vulnerability affects versions 1.6.0 through 1.10.2, and the fix is available in version 1.10.3 or higher.

• Potential unauthorized access to sensitive local files
• Bypassing of server-side configuration restrictions
• Possible data breaches or system compromise
• Need for urgent patching to prevent exploitation

Technical summary

The CVE-2025-66518 vulnerability in Apache Kyuubi Server allows clients to bypass the server-side configuration 'kyuubi.session.local.dir.allow.list' and access local files not listed in the configuration. This issue affects Apache Kyuubi versions from 1.6.0 through 1.10.2. The vulnerability is addressed in version 1.10.3 or higher. Client access to local files not listed in server config can be bypassed, leading to potential unauthorized access to sensitive local files, bypassing of server-side configuration restrictions, and possible data breaches or system compromise. System administrators and security teams should assess exposure and prioritize patching to prevent unauthorized access.

Defensive priority

High-priority patching required for Apache Kyuubi Server instances

Recommended defensive actions

• Patch Apache Kyuubi Server instances to version 1.10.3 or higher
• Review and update server configurations to restrict access to local files
• Monitor for suspicious activity on affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

CVE-2025-66518 details from NVD and Apache sources indicate a high-severity vulnerability in Apache Kyuubi Server. Client access to local files not listed in server config can be bypassed. Affected versions confirmed from 1.6.0 to 1.10.2. Fix available in version 1.10.3 or higher.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.