External Control of System or Configuration Setting Affecting arrow package, versions [7.0.0,26.0.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-ARROW-21279726
- published20 Oct 2026
- disclosed20 Oct 2026
- creditn0mi1k
Introduced: 20 Oct 2026
NewCVE-2026-92287 (opens in a new tab)How to fix?
Upgrade arrow to version 26.0.0 or higher.
Overview
Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the GetKmsClientFromConfigOrKeyMaterial function, which falls back to the KMS URL embedded in a Parquet file's key material when KmsConnectionConfig does not specify one, and forwards it to the pluggable KmsClient without validating the host. An attacker can capture a KMS access token by supplying a Parquet file naming a host they control, which a KmsClient that uses the supplied URL then sends the token to. This requires the application to read Parquet files it does not control with decryption properties configured against a KmsClient, to have left the KMS URL unset in KmsConnectionConfig so the file-controlled value is used, and the KmsClient implementation to perform no host validation of its own.