Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to th…

Apache Kyuubi versions 1.8.0 through 1.11.x contain a Server-Side Request Forgery (SSRF) vulnerability in the Engine UI proxy component. The proxy accepts arbitrary host and port values from the request path and forwards HTTP requests to those destinations without validation. A remote attacker with network access to the proxy can leverage this to cause the Kyuubi server to send HTTP requests to any reachable host, enabling SSRF or open-proxy abuse. No authentication appears required beyond network access to the proxy endpoint. The vulnerability is fixed in version 1.12.0, which disables the Engine UI proxy by default. Users who need the proxy functionality must explicitly re-enable it and configure an allowlist of permitted target hosts via configuration parameters.