~ / search / GHSA-9x53-gr7p-4qf5

GHSA-9x53-gr7p-4qf5

Apache SeaTunnel: Unauthenticated insecure access

Source: GitHub Advisory Database (reviewed) Low CVE-2025-32896

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.seatunnel:seatunnel-engine-server < 2.3.11 2.3.11
Maven org.apache.seatunnel:seatunnel-engine-common < 2.3.11 2.3.11

Details

As written in the advisory (Markdown source, shown as plain text).

# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

References

External links from the advisory. They lead to third-party sites.