critical·Product Based Network Vulnerabilities·Updated Aug 19, 2026

Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

3.4k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-41042

9.1

CVSScritical

Exploitable remotely over the internet · no authentication required.

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

Apache Gravitinoby Apache Software Foundation

AFFECTED< 1.2.1→SAFE ✓≥ 1.2.1

Updated Sep 9, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Check your infrastructure.Right now.

Check your infrastructure.
Right now.