CVE-2026-23904 is an open proxy vulnerability in Apache Kyuubi's Engine UI proxy, and it is worse than a typical SSRF. The distinction matters: SSRF lets an attacker trick your server into fetching internal resources. An open proxy lets them relay traffic through your infrastructure to hit targets they cannot reach directly. If your Kyuubi instance is internet-facing, an attacker uses it as a pivot to reach internal Hadoop/YARN/k8s APIs, metadata services, or data stores behind your firewall — exactly the services that are deliberately NOT internet-accessible.
The vulnerability shipped in Kyuubi 1.8.0 (circa 2022). The Engine UI proxy was designed to accept arbitrary host:port destinations from request paths and forward HTTP traffic there. No validation, no allowlist, no operator configuration required. The feature assumed unrestricted outbound connectivity was acceptable — likely because it was ported from an internal use case where cluster operators were the only consumers.
The fix in version 1.12.0 does two things: it disables the proxy by default, and it requires operators to explicitly configure an allowlist of permitted destinations. This is the right immediate response, but understand what it actually changes. The underlying capability — arbitrary HTTP forwarding from your application server into adjacent network segments — still exists in the code. Re-enabling the feature with a permissive allowlist recreates the exact same exposure. Operators facing configuration friction will likely set the allowlist to * or localhost and move on, which defeats the mitigation.
What you should do: first, confirm whether the Kyuubi Engine UI proxy endpoint (/api/v1/engine/ui/proxy/*) is exposed to untrusted networks. If it is, block it at the network layer immediately — this requires no code change. Second, if you need the Engine UI feature, upgrade to 1.12.0 or later and configure the allowlist with specific hostnames only — never *. Third, audit what the Kyuubi server's network segment can reach. The blast radius of this vulnerability is bounded by whatever your Kyuubi host can communicate with, not by what attackers can directly reach. Assume an attacker who compromises this endpoint can reach every service in that network segment.
The broader lesson: features that create arbitrary outbound connectivity from an application server are inherently high-risk designs. Disabled-by-default helps, but it shifts the trust decision to runtime configuration. The secure outcome would have been removing the capability entirely or scoping it to known Engine UI hostnames at startup — not delegating the security decision to operators who are optimizing for functionality.