CVE-2026-73334

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).  On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter  will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.

• CWE-20

• https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0Mailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/08/11Mailing List, Third Party Advisory

Published

Sep 9, 2026

Last Modified

Sep 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73327Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-73329CamaleonCMS contains a stored cross-site scripting vulnerabi…8.7
• CVE-2026-7333Use after free in GPU in Google Chrome prior to 147.0.7727.1…9.6
• CVE-2026-73330CamaleonCMS 2.9.1 contains a server-side template injection …6.6
• CVE-2026-73331CamaleonCMS 2.9.1 contains an authenticated SQL injection vu…7.1
• CVE-2026-73332CamaleonCMS contains a stored cross-site scripting vulnerabi…8.7
• CVE-2026-73335Android application "Myna Point" is vulnerable to Improper A…4.6
• CVE-2026-73336Joomla! Core - [20260806] - XSS through schema.org outputs i…6.4
• CVE-2026-73337Joomla! Core - [20260807] - MFA Authentication Bypass in Joo…7.5
• CVE-2026-73338Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0…7.1
• CVE-2026-73339Unauthenticated SQL Injection in Modern Events Calendar < 7.…9.3
• CVE-2026-7334Use after free in Views in Google Chrome on Mac prior to 147…8.8