An incomplete fix for a path traversal vulnerability in Apache Kyuubi versions 1.6.0 through 1.11.x allows authenticated attackers to access restricted directory paths.

This is a Path Traversal vulnerability (CWE-22) resulting from an inadequate security fix for a previous CVE. The flaw requires an authenticated user to exploit, allowing them to traverse outside of intended directories to access sensitive system files.

With a CVSS score of 8.1, this vulnerability poses a significant risk to data confidentiality and integrity. If exploited, an attacker could read sensitive configuration files or other restricted data, potentially leading to a broader compromise of the underlying infrastructure.

Immediate Action: Update Apache Kyuubi to version 1.12.0 or higher to ensure the patch for path traversal is fully applied.

Proactive Monitoring: Monitor system logs for file access requests containing directory traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: Ensure the application runs with the least privilege necessary, restricting the service account's ability to access sensitive system directories at the operating system level.

Public Exploit Available: Unknown

Users of Apache Kyuubi must transition to the latest version immediately to close this security gap. The presence of an incomplete fix suggests that standard security controls may be insufficient, making the software update the only reliable mitigation.