CVE-2026-23904

The record

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.

Affected packages

Related vulnerabilities

• CVE-2026-10756 TRO600 contains a vulnerability that allows an authenticated attacker to bypass network… CWE-923
• CVE-2026-70212 Improper restriction of communication channel to intended endpoints in Windows Security… CWE-923
• CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-923
• CVE-2026-62836 Improper restriction of communication channel to intended endpoints in Azure SQL Managed… CWE-923
• CVE-2026-18655 Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the… CWE-923
• CVE-2026-63226 Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. CWE-923
• CVE-2026-8920 Improper Restriction of Communication Channel to Intended Endpoints and External Control… CWE-923
• CVE-2026-57028 An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in… CWE-923