Unauthenticated code execution via H2 INIT
Published Jul 8, 2026 · Updated Jul 8, 2026
Code injection in Apache Gravitino before 1.2.1 allows remote attackers to execute arbitrary Java code through the testConnection API. The API passes an attacker-supplied H2 JDBC URL to the H2 driver without rejecting its INIT parameter, which H2 evaluates during connection setup. The endpoint is unauthenticated, but exploitation requires an H2-backed catalog; H2 is mainly used for testing and local development.
Summary
What happened
Code injection in Apache Gravitino before 1.2.1 allows remote attackers to execute arbitrary Java code through the testConnection API. The API passes an attacker-supplied H2 JDBC URL to the H2 driver without rejecting its INIT parameter, which H2 evaluates during connection setup. The endpoint is unauthenticated, but exploitation requires an H2-backed catalog; H2 is mainly used for testing and local development.
The record
- CVE
- CVE-2026-41042
- Published
- Jul 8, 2026
- Updated
- Jul 8, 2026
- Vendor
- The Apache Software Foundation
- Product
- Apache Gravitino
- Classifications
- CWE-20, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jul 8, 2026CVE publishedPublication date reported by the CVE source.
- Jul 8, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <1.2.1
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- Snyk H2 INIT proof-of-concept descriptionproof of concept · unverified
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo