This vulnerability enables a client that can connect to the Apache Kyuubi Server through its frontend protocols to bypass the server‑side configuration entry kyuubi.session.local.dir.allowlist by supplying unprefixed Spark configuration aliases. The bypass allows the attacker to reference directories outside the intended scope, potentially accessing or modifying arbitrary files on the server filesystem. In effect the flaw provides a path traversal scenario (CWE‑22) combined with improper configuration alias handling (CWE‑27), which can lead to confidentiality and integrity compromise of server files.

The affected product is Apache Kyuubi, maintained by the Apache Software Foundation. Versions from 1.6.0 up to, but not including, 1.12.0 are vulnerable; the security fix was applied in version 1.12.0 and all later releases.

The CVSS score of 8.1 classifies this as a high severity risk. The EPSS score is below 1%, indicating a low likelihood of active exploitation, and CISA has not listed it in its KEV catalog. Exploitation requires only the ability to communicate with the Kyuubi server via its frontend protocol, allowing an attacker who can send configuration parameters to manipulate the allowlist setting. Since the bypass operates with minimal client privileges, the attacker can achieve file system access on the server if no additional network or application‑level controls are in place.