CVE-2026-41566

FAUCET Score

Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: 2.8.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

First published: Jun 25, 2026Last modified: Jun 25, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
Apache Software Foundation	Apache Kvrocks	>= 2.8.0, <= 2.15.0CNA affecteddefault unaffected

CVSS Data

CVSS version used by this source: 4.0

9.4CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:M/U:Amber

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

PASSIVE

VS Confidentiality

HIGH

VS Integrity

HIGH

VS Availability

HIGH

SS Confidentiality

HIGH

SS Integrity

HIGH

SS Availability

HIGH

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

0.29%

Probability of exploitation in next 30 days

EPSS Percentile

21.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.0029 is in the 12th percentile among its peer group of 265 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.6 Bluesky, 0.3 Mastodon, and 1.6 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (1)

apachevendor investigatingvia vendor_rss

View patch

Vendor Advisories (1)

apacheapache:www.mail-archive.com/[email protected]/msg11300.html

CVE-2026-41566: Apache Kvrocks: Improper permission for the APPLYBATCH command

Jun 25, 2026

References

openwall.com / lists/oss-security/2026/06/25/1

lists.apache.org / thread/zng5lp7psgkcv9jnm9tztdlm3rmzfydl