ORG.APACHE.GRAVITINO:CATALOG-JDBC-COMMON · CVE-2025-53648 · Package
FIX → 1.0.0
Apache Gravitino's JDBC catalog configuration validation can be bypassed through the UI, letting a malicious user read or truncate files on the server. The advisory ties the flaw to SQL injection (CWE-89) in versions 0.5.0 through 1.0.0.
first public Jun 30, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache Gravitino between 0.5.0 and 1.0.0 that expose its UI to users who can create or edit JDBC catalogs. The sources describe the risk as coming from a malicious user of the UI, so deployments with only trusted administrators or no UI exposure are lower risk. Teams on 1.0.0 or later are not affected.
Not affected if no-ui-exposure, version-1.0.0-or-later
Who cares apache-gravitino, cwe-89, java, jdbc, self-hosted
org.apache.gravitino:catalog-jdbc-common in your build files, looking for anything from 0.5.0 up to but not including 1.0.0Upgrade to 1.0.0
SQL misconfiguration in the Gravitino UI, in versions 0.5.0 until 1.0.0, can allow a malicious user to read or truncate files. Users are recommended to upgrade to version 1.0.0, which fixes this issue.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
org.apache.gravitino:catalog-jdbc-common to 1.0.0GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.