CVE Intelligence
Analysis AI-assisted

CVE-2026-41566: Apache Kvrocks: Insufficient Permissions Handling Vulnerability

CVE-2026-41566 is a vulnerability in Apache Kvrocks classified as improper handling of insufficient permissions or privileges (CWE-280). The CNA reports that version 2.8.0 is affected and recommends upgrading to version 2.16.0, which fixes the issue. The CNA-supplied CVSS 4.0 base score is 9.4 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-41566 affects Apache Kvrocks, a key-value store. The issue is categorized as improper handling of insufficient permissions or privileges (CWE-280). The Apache Software Foundation CNA published the record on 2026-06-25.

Impact

The record does not describe the specific impact beyond the weakness classification. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack requirements, low privileges required, and user interaction required, with high impact on confidentiality, integrity and availability of the vulnerable system. These are CNA-supplied metrics and should be read as the vendor's assessment.

Affected products and versions

  • Apache Kvrocks: version 2.8.0 is listed as affected.
  • The structured affected-product data is empty in the record, so other affected versions are unknown.
  • Upgrading to version 2.16.0 is recommended by the CNA as the fixed version.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed active exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade Apache Kvrocks to version 2.16.0 or later, as recommended by the CNA.
  • Review the vendor mailing-list thread and the oss-security post for any additional guidance.
  • Review access control and privilege configurations for Kvrocks deployments while planning the upgrade.

Detection guidance

  • Inventory Kvrocks instances and identify those running version 2.8.0 or other versions below 2.16.0.
  • Monitor access logs and authentication events for unexpected privileged operations, as a high-level precaution.

Limitations of the available information

The record does not state whether versions between 2.8.0 and 2.16.0 are affected, and it provides no detailed technical description of the permission flaw. The CVSS 4.0 vector contains many threat and environmental fields set to X (not defined). No CISA ADP, SSVC or EPSS data is included.

Frequently asked questions

Which Apache Kvrocks version is affected by CVE-2026-41566?

The CNA lists version 2.8.0 as affected. The record does not provide a complete list of affected versions.

What version should I upgrade to?

The CNA recommends upgrading to version 2.16.0, which fixes the issue.

Is this CVE being actively exploited?

It is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.