A server-side request forgery vulnerability has been discovered in Apache Gravitino. The flaw affects versions 1.0.0 through 1.2.1 and allows authenticated attackers to fetch internal metadata and cloud credentials from affected servers.
The vulnerability is tracked as CVE-2026-49876. Security researcher Ajay Rajpurohit discovered and published a proof-of-concept exploit for the flaw.
Let me break down the Apache Gravitino SSRF vulnerability and what organizations need to know.
Important Vulnerability Details
- Apache Gravitino affected versions - 1.0.0 to 1.2.1
- Vulnerability lies in fetchFileFromUri()method inside JobManager.java
- Method handles URIs obtained from fields in job templates without validation
- It supports http, https and ftp schemes
- URIs are resolved in server staging directory
- This vulnerability is exploitable by authenticated users
- Metadata and cloud credentials are in danger
How the Flaw Works
The Apache Gravitino SSRF vulnerability is rooted in the fetchFileFromUri() method in JobManager.java.
This method processes URIs from job template fields such as:
- executable
- scripts
- jars
- files
- archives
The method does not validate the destination URI. This supports http, https, and ftp schemes. Remote contents are downloaded to the staging directory on the server using FileUtils.copyURLToFile().
Attacker Capabilities:
- Register the job template using an internal or metadata URL
- Launch the job execution and make the server download the URL
- Extract the downloaded contents from the staging directory
- Perform Blind SSRF Detection using OOB callbacks
Exploitation Steps
The Apache Gravitino SSRF vulnerability can be exploited in a straightforward sequence:
Step 1: Authentication
- The attacker needs a valid Gravitino user account
- Any role with job template privileges is sufficient
Step 2: Template Registration
- The attacker registers a job template
- The executable field contains the SSRF URL
Step 3: Job Execution
- The attacker triggers a job run
- The server fetches the URL
Step 4: Data Retrieval
- The server downloads content to the staging directory
- If accessible, the attacker reads the downloaded content
What Can Be Targeted
The Apache Gravitino SSRF vulnerability can be used to access:
Internal Services:
- Internal configuration endpoints
- Service discovery endpoints
- Internal APIs
- Database endpoints
Cloud Metadata Services:
- AWS IMDSv1 (169.254.169.254)
- GCP metadata server
- Azure Instance Metadata Service
- Internal Files and Configurations:
- Configuration files
- Property files
- Credential files
Affected Versions
The Apache Gravitino SSRF vulnerability affects:
- Apache Gravitino 1.0.0
- Apache Gravitino 1.1.0
- Apache Gravitino 1.2.0
- Apache Gravitino 1.2.1
A patch is available in a fixed version. Organizations are advised to review the Apache security advisory for the most up-to-date information.
Steps That Should Be Taken by Organizations
It is urgent that organizations address the Apache Gravitino SSRF vulnerability.
Immediate Actions:
- Patch the Apache Gravitino to its latest update
- Update to a new version
- Read the Apache Security Advisory
- Alternatives (in case of delay in applying patches):
- Limit access to the Gravitino server
- Implement network segmentation
- Look out for suspicious job template registrations
Detection:
- Monitor for unusual job template registrations
- Look for internal or metadata URLs in executable fields
- Check for outbound requests to unexpected destinations
Exploit Author
The Apache Gravitino SSRF vulnerability was discovered by security researcher Ajay Rajpurohit. The researcher published a full proof-of-concept exploit demonstrating the flaw.
Exploit Features:
- Python based
- Uses the requests library
- Tests for SSRF directly
- Enables cloud metadata theft
- Performs blind SSRF with OOB callbacks
Conclusion
Apache Gravitino SSRF Vulnerability is an important security issue that affects versions 1.0.0 – 1.2.1, which enables attackers with access to get metadata and credentials from the cloud.
Key points to remember:
- CVE-2026-49876 affects Gravitino 1.0.0 through 1.2.1
- The fetchFileFromUri() method does not validate destination URIs
- http, https, and ftp schemes are accepted
- Cloud metadata services are at risk
- Authenticated users can exploit the vulnerability
- A patch is available from Apache
Organizations should apply the Apache patch immediately. Restrict access to Gravitino servers. Beware of job template registrations that could be suspicious.
Apache Gravitino SSRF Vulnerability points out that there is a possibility of data leakage because of server-side request forgery problem. It’s important to keep an eye on it.
FAQ Section
What is the Apache Gravitino SSRF vulnerability?
CVE-2026-49876 refers to a server side request forgery vulnerability affecting Apache Gravitino from version 1.0.0 to 1.2.1, which enables an attacker with authentication capability to fetch internal metadata and cloud credentials.
How does the vulnerability work?
There is a class called JobManager.java which contains a method named fetchFileFromUri() where URI inputs are entered which are received from job template but not validated. The method supports http, https, and ftp schemes and downloads content to the server's staging directory.
What can attackers target?
Attacker's targets can include internal services, cloud metadata services such as AWS IMDS, GCP and Azure and internal configuration files.
What versions are affected?
Apache Gravitino versions 1.0.0 through 1.2.1 are affected. A patch is available in a fixed version.
What should organizations do?
Apply the Apache patch immediately. Restrict access to Gravitino servers. Check for job template registration with suspicious internal or metadata URLs.
