---
id: CVE-2026-92287
title: >-
  arrow: pyarrow: arrow: Information disclosure via unvalidated KMS URLs in
  Parquet files (CVE-2026-92287)
summary: >-
  A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet
  files configured with a Key Management Service (KMS) client, unvalidated KMS
  server addresses embedded within the file can be passed directly to the client
  implem…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-918
  - CWE-20
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - exploit_intelligence
  - lightspeed_core
  - migration_toolkit_for_applications 8
  - openshift_lightspeed
  - ai_inference_server
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T09:36:12+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92287.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92287.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92287'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2556026'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92287'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92287'
  - url: 'https://github.com/apache/arrow/issues/51349'
  - url: 'https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-20T12:05:07.348Z'
---

## Overview

A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service (KMS) client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implementation. An attacker can supply a maliciously crafted Parquet file to trigger the transmission of sensitive authentication tokens to an attacker-controlled server, resulting in information disclosure.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ceph Storage 7, … · no fix planned: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92287.json)

**arrow: pyarrow: arrow: Information disclosure via unvalidated KMS URLs in Parquet files** — rated Moderate by Red Hat. Released 2026-10-20.

Affected:

- Exploit Intelligence
- Lightspeed Core
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Exploit Intelligence
- Lightspeed Core
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

## Remediation

Out of support scope