CVE-2026-41566: Apache Kvrocks: Improper permission for the APPLYBATCH command

Synopsis

An improper privilege-handling flaw in Apache Kvrocks (versions up to and including 2.15.0) allows a low-privilege authenticated user to invoke the APPLYBATCH command without adequate permission checks. The vulnerability is reachable over the network and requires the victim to take some action to complete the exploit chain. Successful exploitation gives the attacker full read, write, and availability impact on both the affected Kvrocks instance and any connected systems. HarborGuard is tracking the upstream advisory for patch availability, as no official fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Kvrocks service over the network; the CVSS vector specifies AV:N, meaning the service must be exposed to the attacker's network.

• AuthenticationRequired

  The attacker must hold a low-privilege account on the Kvrocks instance; any non-anonymous credential is sufficient to attempt the APPLYBATCH abuse (PR:L).

• Victim interactionRequired

  The CVSS vector specifies UI:P, meaning some level of participation or action by a user or operator is required to complete exploitation, introducing a social-engineering or timing dependency.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker reads all data stored in the Kvrocks instance, including keys, values, and any cached session or application state (VC:H).
• The attacker modifies or deletes persisted data in Kvrocks, corrupting application state or injecting malicious records (VI:H).
• The attacker crashes or degrades the Kvrocks service, causing denial of availability for any application depending on it (VA:H).
• Because subsequent system impact scores are also High (SC:H, SI:H, SA:H), the attacker can extend read, write, and disruption impact beyond Kvrocks to connected downstream systems.