{"id":"CVE-2026-92287","title":"arrow: pyarrow: arrow: Information disclosure via unvalidated KMS URLs in Parquet files (CVE-2026-92287)","summary":"A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service (KMS) client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implem…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-918","CWE-20"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","lightspeed_core","migration_toolkit_for_applications 8","openshift_lightspeed","ai_inference_server","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T09:36:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92287.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92287.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-92287"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556026"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92287"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92287"},{"url":"https://github.com/apache/arrow/issues/51349"},{"url":"https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-20T12:05:07.348Z","slug":"CVE-2026-92287","body":"## Overview\n\nA flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service (KMS) client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implementation. An attacker can supply a maliciously crafted Parquet file to trigger the transmission of sensitive authentication tokens to an attacker-controlled server, resulting in information disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ceph Storage 7, … · no fix planned: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92287.json)\n\n**arrow: pyarrow: arrow: Information disclosure via unvalidated KMS URLs in Parquet files** — rated Moderate by Red Hat. Released 2026-10-20.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225675,"id":"CVE-2026-92287","ts":1792498349837,"field":"cvss","old":null,"new":"4.7"},{"seq":225674,"id":"CVE-2026-92287","ts":1792498349837,"field":"severity","old":"none","new":"medium"}]}