{"action":"Upgrade apache-gravitino to 1.2.1 or later.","affected":[{"fixed":"1.2.1","introduced":"1.0.0"}],"component":"apache-gravitino","cve_ids":["CVE-2026-41041"],"ecosystem":"PyPI","epss":0.00597,"exploited":false,"fixed_versions":["1.2.1"],"id":"tcs_01M5KH5BZHKYDPCK2F7Y6PTCTX","modified_at":"2026-07-14T10:45:07.639819905Z","published_at":"2026-07-13T10:16:28.803Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3441","http://www.openwall.com/lists/oss-security/2026/07/13/1","https://lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-3441","url":"https://osv.dev/vulnerability/PYSEC-2026-3441"}],"summary":"URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino."}