IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-07-08 12:17

MODIFIED

2026-07-08 12:17

EPSS (Prob. Exploit)

1.51%

Top 25.7%

🎯 NUCLEI TEMPLATE

DATA SOURCES:

NVD 🔗 2026-07-08 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 NUCLEI 🔗 2026-11-01

> DESCRIPTION

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-20

> CWE DETAILED DESCRIPTIONS

CWE-20: Improper Input Validation - The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

> NUCLEI TEMPLATES

Des templates Nuclei sont disponibles pour scanner cette vulnérabilité.

🎯

CVE-2026-41042.yaml

http/cves/2026/CVE-2026-41042.yaml

Usage: nuclei -t http/cves/2026/CVE-2026-41042.yaml -u target.com

> HISTORIQUE DES MODIFICATIONS

Première apparition

08/07/2026 12:17

Source: NVD

📊 ENRICHISSEMENT 01/08/2026 06:01

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-20: Improper Input Validation - The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process...

Total des modifications: 1 Dernière mise à jour: 3 months ago

> REFERENCES

https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm