CVE-2026-23904 Apache CVE debrief

Who should care

Apache Kyuubi users, administrators, and security teams should be aware of this vulnerability and take necessary actions to mitigate the risk. They should prioritize upgrading to version 1.12.0, which disables the proxy by default. Additionally, users should review their current configurations and ensure that allowed target hosts are properly configured if the proxy is required. Security teams should also monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and vulnerability management teams should also be informed to ensure proper tracking and remediation of affected systems. This vulnerability can have significant operational impacts if not properly addressed, making it crucial for all relevant stakeholders to take appropriate actions. The affected product deployments should be identified, and owners should be assigned for follow-up actions. Compensating controls should be reviewed for exposed systems, and relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested before closing the item, ensuring that evidence is properly documented. This requires a coordinated effort from various teams to ensure comprehensive mitigation and minimize potential risks. The vulnerability's impact on the organization depends on the specific use cases and configurations of Apache Kyuubi within their environments, emphasizing the need for a thorough review of affected scope and severity. Therefore, it is critical for all stakeholders to be proactive in their response to this vulnerability. The CVE record and NVD entry provide essential information for understanding the vulnerability and its implications, and users are advised to consult these sources for the most accurate and up-to-date information. By taking these steps, organizations can effectively manage the risks associated with CVE-2026-23904 and protect their systems from potential exploitation. The debrief and technical summary provide additional context and details that can help in understanding and mitigati

Technical summary

The Kyuubi Engine UI proxy vulnerability (CVE-2026-23904) allows a remote requester to cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi versions from 1.8.0 before 1.12.0. The vulnerability is addressed by upgrading to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, users can set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts. It is essential for users to prioritize upgrading to version 1.12.0 to prevent potential SSRF or open-proxy behavior.

Defensive priority

Apache Kyuubi users should prioritize upgrading to version 1.12.0, which disables the proxy by default, to prevent potential SSRF or open-proxy behavior.

Recommended defensive actions

• Upgrade to Apache Kyuubi version 1.12.0 or later
• Disable the proxy by default
• Configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts if proxy is required
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-23904 record indicates that the Kyuubi Engine UI proxy vulnerability allows a remote requester to cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts. The issue affects Apache Kyuubi versions from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0. Evidence is based on official CVE and NVD records.

Official resources