CVE WatchJul 8, 2026

CVE-2026-41042

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server

CVSS

9.1

Critical

EPSS

0.3%

p21

KEV

—

Exploit Today

0-100

Published: Jul 8, 2026 · Last modified: Jul 8, 2026 · CWE-20

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-07-092026-07-21

Technical description

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-16422—

—

——0Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)4h CVE-2026-16415—

—

——0Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)4h CVE-2026-16414—

—

——0Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)4h CVE-2026-648778.4 HIG

—

——0An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.7h CVE-2026-15792—

—

——0A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.8h CVE-2026-157248.7 HIG

—

——0In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.8h