CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

CVE-2026-73334 is an improper input validation flaw (CWE-20) in the org.apache.parquet.crypto.keytools package of Apache Parquet, versions 1.12 through 1.18, which implements envelope encryption of Parquet files with data keys wrapped via a Key Management Service. The flaw is triggered when a reader does not application-control the KMS URL parameter, causing the KMS URL embedded in the Parquet file itself to be forwarded to a pluggable KmsClient implementation; if that client does not validate the destination host, the KMS token is sent to a malicious host specified by the attacker inside the file. An attacker who can supply or tamper with a Parquet file read under this configuration can capture the KMS token, potentially exposing key-management credentials and enabling unauthorized access to encrypted data keys — this is a credential/secret exposure issue, not remote code execution. Users of Parquet's envelope-encryption feature who rely on file-controlled KMS URLs with custom KmsClient plugins lacking host validation are affected; readers that set the KMS URL via application control are not exposed. The issue has not yet received a CVSS score, is not in CISA KEV, has no known public proof-of-concept, and there is no known exploitation in the wild; a fix is expected in version 1.19, which will disable file-controlled KMS URLs by default.

Do: Until the fixed release (1.19, where file-controlled KMS URL is disabled by default) is available, configure readers to set the KMS URL via application control rather than trusting the URL embedded in untrusted Parquet files. If file-controlled KMS URLs must be used, ensure your custom KmsClient implementation validates the target host and uses authentication, and only process Parquet files from trusted sources. Once version 1.19 is released, upgrade and only re-enable file-controlled KMS URLs via the new application parameter if host validation and authentication are implemented in your KMS client plugin.