Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-74761 (GCVE-0-2026-74761)

Vulnerability from nvd – Published: 2026-09-09 11:10 – Updated: 2026-09-09 11:11

Title

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Summary

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Severity

No CVSS data available.

CWE

CWE-20 - Improper Input Validation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/n9md06jo7ccqmj2mn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

3 products

Vendor	Product	Version
Apache Software Foundation	Apache ActiveMQ Broker	Affected: 6.0.0 , < 6.3.2 (semver) Affected: 0 , < 5.19.11 (semver)
Apache Software Foundation	Apache ActiveMQ All	Affected: 6.0.0 , < 6.3.2 (semver) Affected: 0 , < 5.19.11 (semver)
Apache Software Foundation	Apache ActiveMQ	Affected: 6.0.0 , < 6.3.2 (semver) Affected: 0 , < 5.19.11 (semver)

Credits

Wanxin Yin (yaklang.io)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:11:01.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-broker",
          "product": "Apache ActiveMQ Broker",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.3.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-all",
          "product": "Apache ActiveMQ All",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.3.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.3.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wanxin Yin (yaklang.io)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All\u0026nbsp;on all platforms.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAn authenticated client can spoof clientId when removing a durable topic subscription.\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All\u00a0on all platforms.\n\n\n\n\nAn authenticated client can spoof clientId when removing a durable topic subscription.\n\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.\n\n\n\nUsers are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T11:10:16.065Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-74761",
    "datePublished": "2026-09-09T11:10:16.065Z",
    "dateReserved": "2026-08-15T13:53:34.221Z",
    "dateUpdated": "2026-09-09T11:11:01.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73334 (GCVE-0-2026-73334)

Vulnerability from nvd – Published: 2026-09-09 10:48 – Updated: 2026-09-09 11:10

Title

Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Summary

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.

Severity

No CVSS data available.

CWE

CWE-20 - Improper Input Validation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ro2vomk9xxhv34xhv…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Parquet Hadoop	Affected: 1.12 , ≤ 1.18.0 (custom)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:59.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.parquet.crypto.keytools:parquet-hadoop",
          "packageURL": "pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop",
          "product": "Apache Parquet Hadoop",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.18.0",
              "status": "affected",
              "version": "1.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Potential problem for users of the\u0026nbsp;org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \u003cbr\u003eThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u0026nbsp;\u003cbr\u003eOn the reader side, the KMS URL can be application-controlled or file-controlled.\u003cbr\u003e\u003cspan\u003eIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \u003cbr\u003eIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003eBefore the problem is fixed, users are recommended to\u0026nbsp;leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\u003cbr\u003eAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u0026nbsp;\u003cbr\u003ewill have two options then:\u0026nbsp;leverage application control for KMS URL parameter in readers, or enable file-controlled\u0026nbsp;KMS URL (via a new app parameter).\u003cbr\u003eThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."
            }
          ],
          "value": "Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:48:46.250Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-73334",
    "datePublished": "2026-09-09T10:48:46.250Z",
    "dateReserved": "2026-08-12T06:00:31.756Z",
    "dateUpdated": "2026-09-09T11:10:59.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65181 (GCVE-0-2026-65181)

Vulnerability from nvd – Published: 2026-09-09 10:40 – Updated: 2026-09-09 11:10

Title

Apache Impala: RCE via External Data Source Class Loading

Summary

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-913 - Improper Control of Dynamically-Managed Code Resources

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/2ty3srsh96j86xxg4…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 2.7.0 , ≤ 4.5.1 (semver)

Credits

zhaokaifei ChinaTelecom

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:57.722Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/24"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zhaokaifei ChinaTelecom"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.\u003cbr\u003eUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
            }
          ],
          "value": "Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:40:51.317Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2ty3srsh96j86xxg4g1hbo5rwvszwcnl"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Impala: RCE via External Data Source Class Loading",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-65181",
    "datePublished": "2026-09-09T10:40:51.317Z",
    "dateReserved": "2026-07-21T18:05:06.002Z",
    "dateUpdated": "2026-09-09T11:10:57.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57866 (GCVE-0-2026-57866)

Vulnerability from nvd – Published: 2026-09-09 10:39 – Updated: 2026-09-09 11:10

Title

Apache Impala: Secrets Exfiltration via SSRF

Summary

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.

Severity

No CVSS data available.

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/nnk4660cbs6dmmkch…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 4.4.0 , ≤ 4.5.1 (semver)

Credits

Andrey Rukin (Arenadata)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:47.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/23"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrey Rukin (Arenadata)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.\u0026nbsp; Authenticated Impala users with permissions to execute the\u0026nbsp;\u003cspan\u003e\u003cspan\u003eai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `\u003ccode\u003ehadoop.security.credential.provider.path` property of `\u003c/code\u003ecore-site.xml`. The secret\u0027s key must be known to the user.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.\u00a0 Authenticated Impala users with permissions to execute the\u00a0ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret\u0027s key must be known to the user."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:39:47.244Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/nnk4660cbs6dmmkch7ch7wwb3g9myw7j"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Impala: Secrets Exfiltration via SSRF",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-57866",
    "datePublished": "2026-09-09T10:39:47.244Z",
    "dateReserved": "2026-06-25T21:30:09.873Z",
    "dateUpdated": "2026-09-09T11:10:47.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56207 (GCVE-0-2026-56207)

Vulnerability from nvd – Published: 2026-09-09 10:36 – Updated: 2026-09-09 11:10

Title

Apache Impala: SAML authentication bypass via forged bearer token

Summary

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/20cov78py0zqzx7dy…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 4.0.0 , ≤ 4.5.1 (semver)

Credits

Andrew Rukin (Arenadata)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:45.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/22"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrew Rukin (Arenadata)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSignature of Bearer token is not verified in last step of SAML2 authentication for Impala\u0027s hs2-http interface, allowing altering user name and acting as another user.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Impala: \u0026gt;=4.0.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 4.5.2, which fixes this issue.\u003c/p\u003e"
            }
          ],
          "value": "Signature of Bearer token is not verified in last step of SAML2 authentication for Impala\u0027s hs2-http interface, allowing altering user name and acting as another user.\n\n\n\nThis issue affects Apache Impala: \u003e=4.0.0.\n\n\n\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:36:55.238Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/20cov78py0zqzx7dyq39ktythkwn91zs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Impala: SAML authentication bypass via forged bearer token",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-56207",
    "datePublished": "2026-09-09T10:36:55.238Z",
    "dateReserved": "2026-06-19T15:49:57.313Z",
    "dateUpdated": "2026-09-09T11:10:45.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54048 (GCVE-0-2026-54048)

Vulnerability from nvd – Published: 2026-09-09 10:34 – Updated: 2026-09-09 11:10

Title

Apache Impala: Avro Schema URL Server-Side Request Forgery

Summary

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/cn3q4s8yx924ndlm3…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 2.0.0 , ≤ 4.5.1 (semver)

Credits

zhaokaifei ChinaTelecom

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:35.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zhaokaifei ChinaTelecom"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Specifying tblproperties(\u0027avro.schema.url\u0027=\u0027\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://...\u0027\"\u003ehttp://...\u0027\u003c/a\u003e) or with a \u0027file:///\u0027 URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.\u003cbr\u003eUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
            }
          ],
          "value": "Specifying tblproperties(\u0027avro.schema.url\u0027=\u0027 http://...\u0027 ) or with a \u0027file:///\u0027 URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:34:01.432Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Impala: Avro Schema URL Server-Side Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-54048",
    "datePublished": "2026-09-09T10:34:01.432Z",
    "dateReserved": "2026-06-11T17:21:18.283Z",
    "dateUpdated": "2026-09-09T11:10:35.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41871 (GCVE-0-2026-41871)

Vulnerability from nvd – Published: 2026-09-09 10:45 – Updated: 2026-09-09 11:10

Title

Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/rbr63fx8vlrhzrfkn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Nutch	Affected: 1.10 , ≤ 1.22 (custom)

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:19.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u0026nbsp;in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.10 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:45:47.005Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41871",
    "datePublished": "2026-09-09T10:45:47.005Z",
    "dateReserved": "2026-04-22T06:35:10.384Z",
    "dateUpdated": "2026-09-09T11:10:19.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41870 (GCVE-0-2026-41870)

Vulnerability from nvd – Published: 2026-09-09 10:43 – Updated: 2026-09-09 11:10

Title

Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-913 - Improper Control of Dynamically-Managed Code Resources
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/3pl59g0jzqx1bdh5w…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/4

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Nutch	Affected: 1.11 , ≤ 1.22 (custom)

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:16.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Improper Control of Generation of Code (\u0027Code Injection\u0027), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u0026nbsp;in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.11 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Improper Control of Generation of Code (\u0027Code Injection\u0027), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.11 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:43:04.894Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/3pl59g0jzqx1bdh5w92qoftzn7c3x8j2"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165",
          "NUTCH-3168"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41870",
    "datePublished": "2026-09-09T10:43:04.894Z",
    "dateReserved": "2026-04-22T06:33:41.605Z",
    "dateUpdated": "2026-09-09T11:10:16.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41869 (GCVE-0-2026-41869)

Vulnerability from nvd – Published: 2026-09-09 10:44 – Updated: 2026-09-09 11:10

Title

Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-404 - Improper Resource Shutdown or Release

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ps4yhlvo6kdgmksdg…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/3

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Nutch	Affected: 1.10 , ≤ 1.22 (custom)

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:14.888Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.10 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404 Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:44:30.167Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41869",
    "datePublished": "2026-09-09T10:44:30.167Z",
    "dateReserved": "2026-04-22T06:29:48.621Z",
    "dateUpdated": "2026-09-09T11:10:14.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75156 (GCVE-0-2026-75156)

Vulnerability from nvd – Published: 2026-09-08 16:47 – Updated: 2026-09-08 19:00

Title

Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

Summary

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:59 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

apache mitre root

References

3 references

URL	Tags
https://github.com/apache/airflow/pull/71735	patch
https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l…	vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-59243	related

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Airflow FAB provider	Affected: 3.7.3 , < 3.8.1 (semver)

Credits

Roberto Nunes NEO AI Engineer (@neo-ai-engineer, ProjectDiscovery) Jarek Potiuk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-75156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:59:35.794768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T19:00:04.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-fab",
          "product": "Apache Airflow FAB provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.8.1",
              "status": "affected",
              "version": "3.7.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Roberto Nunes"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "NEO AI Engineer (@neo-ai-engineer, ProjectDiscovery)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jarek Potiuk"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft\u0026#x27;s **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant \u2014 including one the attacker creates \u2014 passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment.\u003cbr\u003e\u003cbr\u003eThe fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** \u2014 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later."
            }
          ],
          "value": "Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft\u0027s **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant \u2014 including one the attacker creates \u2014 passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment.\n\nThe fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** \u2014 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T16:47:48.290Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/71735"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59243"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated \u2014 cross-tenant authentication bypass",
      "x_generator": {
        "engine": "airflow-s/generate_cve_json.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-75156",
    "datePublished": "2026-09-08T16:47:48.290Z",
    "dateReserved": "2026-08-17T18:58:02.812Z",
    "dateUpdated": "2026-09-08T19:00:04.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78254 (GCVE-0-2026-78254)

Vulnerability from nvd – Published: 2026-09-07 07:41 – Updated: 2026-09-08 15:45

Title

Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

Summary

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:44 UTC

CWE

CWE-23 - Relative path traversal

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/05s46qrlbhd06c6rs…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/06/2

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Ant	Affected: 1.2 , < 1.10.18 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-07T08:16:01.151Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/06/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78254",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:44:47.827022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:45:11.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.ant:ant",
          "product": "Apache Ant",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.10.18",
              "status": "affected",
              "version": "1.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker\u0027s choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. \u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eIn order to exploit this vulnerability, the server would either have to be malicious\u0026nbsp;or be subject to a machine-in-the-middle attack. Additionally\u0026nbsp;in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eFor ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eStarting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the  old behavior is required by existing build files.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eMitigations:\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003eAll users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue."
            }
          ],
          "value": "The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker\u0027s choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. \n\n\n\n\nIn order to exploit this vulnerability, the server would either have to be malicious\u00a0or be subject to a machine-in-the-middle attack. Additionally\u00a0in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.\n\n\n\n\nFor ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.\n\n\n\n\nStarting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the  old behavior is required by existing build files.\n\n\n\n\nMitigations:\n\n\n\n\nUsers of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.\n\n\n\n\nAll users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative path traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T07:41:54.077Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/05s46qrlbhd06c6rsgvxh8zo0l4p9scz"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-78254",
    "datePublished": "2026-09-07T07:41:54.077Z",
    "dateReserved": "2026-08-24T07:17:27.205Z",
    "dateUpdated": "2026-09-08T15:45:11.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52691 (GCVE-0-2026-52691)

Vulnerability from nvd – Published: 2026-09-04 13:39 – Updated: 2026-09-08 18:55 Unsupported When Assigned

Title

Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module

Summary

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:55 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ocjolvzl804qlkto2…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/04/4

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Griffin Hive Metastore Module	Affected: 0 , ≤ * (semver)

Credits

Firebasky ( https://github.com/firebasky )

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T15:07:20.498Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/04/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-52691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:55:17.598906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:55:35.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.griffin:service",
          "product": "Apache Griffin Hive Metastore Module",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Firebasky ( https://github.com/firebasky )"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Apache Griffin Hive Metastore Module.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis issue affects Apache Griffin Hive Metastore Module: all versions.\u003c/p\u003e\u003cp\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\u003c/p\u003e\u003cp\u003eNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Apache Griffin Hive Metastore Module.\u00a0\n\n\n\nThis issue affects Apache Griffin Hive Metastore Module: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T13:39:10.779Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ocjolvzl804qlkto2vx685f8o23vxxlo"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-52691",
    "datePublished": "2026-09-04T13:39:10.779Z",
    "dateReserved": "2026-06-08T09:04:24.173Z",
    "dateUpdated": "2026-09-08T18:55:35.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85229 (GCVE-0-2026-85229)

Vulnerability from nvd – Published: 2026-09-04 07:01 – Updated: 2026-09-08 18:57 Unsupported When Assigned

Title

Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)

Summary

** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:56 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

apache mitre root

References

1 reference

URL	Tags
https://lists.apache.org/thread/oswo0kxr7g2jgdoz3…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache SkyWalking	Affected: 10.2.0 , ≤ 10.4.0 (semver)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-85229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:56:52.746783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:57:06.433Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache SkyWalking",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "10.4.0",
              "status": "affected",
              "version": "10.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003e** UNSUPPORTED WHEN ASSIGNED **\u0026nbsp;\u003c/span\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache SkyWalking Booster UI.\u003c/p\u003e\u003cp\u003eThis issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED **\u00a0Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache SkyWalking Booster UI.\n\n\n\nThis issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.\n\n\n\nUsers are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T07:01:39.869Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/oswo0kxr7g2jgdoz3wd923nslo36jsv8"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-85229",
    "datePublished": "2026-09-04T07:01:39.869Z",
    "dateReserved": "2026-09-03T14:47:23.119Z",
    "dateUpdated": "2026-09-08T18:57:06.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80190 (GCVE-0-2026-80190)

Vulnerability from nvd – Published: 2026-09-04 07:06 – Updated: 2026-09-04 19:42

Title

Apache Allura: Stored XSS via code repositories

Summary

Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:41 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/fsj2dgdzskky4wkck…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/03/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Allura	Affected: 0 , ≤ 1.20.0 (semver)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T07:11:22.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/03/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-80190",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:41:45.587262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:42:07.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Allura",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.20.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApache Allura: stored XSS via SVN code repositories.\u0026nbsp; Git repositories are not known to be affected.\u0026nbsp; The vulnerability is likely mitigated via default CSP headers.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Allura: through 1.20.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.21.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Apache Allura: stored XSS via SVN code repositories.\u00a0 Git repositories are not known to be affected.\u00a0 The vulnerability is likely mitigated via default CSP headers.\n\n\n\nThis issue affects Apache Allura: through 1.20.0.\n\n\n\nUsers are recommended to upgrade to version 1.21.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T07:06:19.844Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/fsj2dgdzskky4wkckhh3fth0ogj5trq2"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Allura: Stored XSS via code repositories",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-80190",
    "datePublished": "2026-09-04T07:06:19.844Z",
    "dateReserved": "2026-08-25T22:37:58.367Z",
    "dateUpdated": "2026-09-04T19:42:07.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81270 (GCVE-0-2026-81270)

Vulnerability from nvd – Published: 2026-09-04 06:59 – Updated: 2026-09-04 19:42

Title

Apache Allura: Information exposure via search

Summary

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:42 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/xvg5m12k3nngcomfr…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/03/6

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Allura	Affected: 0 , ≤ 1.20.0 (semver)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T07:11:25.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/03/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-81270",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:42:37.063434Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:42:56.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Allura",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.20.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApache Allura: exposure of non-public information via search.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Allura: through 1.20.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.21.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Apache Allura: exposure of non-public information via search.\n\n\n\nThis issue affects Apache Allura: through 1.20.0.\n\n\n\nUsers are recommended to upgrade to version 1.21.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T06:59:49.532Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/xvg5m12k3nngcomfrgvkvdy54srjmtyg"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Allura: Information exposure via search",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-81270",
    "datePublished": "2026-09-04T06:59:49.532Z",
    "dateReserved": "2026-08-26T17:20:47.153Z",
    "dateUpdated": "2026-09-04T19:42:56.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80181 (GCVE-0-2026-80181)

Vulnerability from nvd – Published: 2026-09-04 06:52 – Updated: 2026-09-08 18:57

Title

Apache Allura: Server-side request forgery

Summary

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:57 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/v4nplqchsmdg9sdhp…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/03/4

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Allura	Affected: 0 , ≤ 1.20.0 (semver)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T07:11:20.382Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/03/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-80181",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:57:26.126271Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:57:42.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Allura",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.20.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eApache Allura\u0027s\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003cspan\u003ewebhooks\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003eare vulnerable to Server-Side Request Forgery (SSRF).\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache Allura: through 1.20.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.21.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Apache Allura\u0027s\u00a0webhooks\u00a0are vulnerable to Server-Side Request Forgery (SSRF).\n\n\n\n\nThis issue affects Apache Allura: through 1.20.0.\n\n\n\nUsers are recommended to upgrade to version 1.21.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T06:52:42.990Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/v4nplqchsmdg9sdhp91f8hn03rlq8y7s"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Allura: Server-side request forgery",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-80181",
    "datePublished": "2026-09-04T06:52:42.990Z",
    "dateReserved": "2026-08-25T21:18:29.060Z",
    "dateUpdated": "2026-09-08T18:57:42.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80180 (GCVE-0-2026-80180)

Vulnerability from nvd – Published: 2026-09-04 06:50 – Updated: 2026-09-04 19:43

Title

Apache Allura: Stored XSS via markdown HTML processing

Summary

Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:43 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/rjo2hjhp76qhl9f3b…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/03/3

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Allura	Affected: 0 , ≤ 1.20.0 (semver)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T07:11:18.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/03/3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-80180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:43:17.506304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:43:36.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Allura",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.20.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStored XSS via markdown HTML processing\u0026nbsp;in Apache Allura.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Allura: from through 1.20.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version\u0026nbsp;1.21.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Stored XSS via markdown HTML processing\u00a0in Apache Allura.\n\n\n\nThis issue affects Apache Allura: from through 1.20.0.\n\n\n\nUsers are recommended to upgrade to version\u00a01.21.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T06:50:14.773Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rjo2hjhp76qhl9f3br8jq909mohvzkpq"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Allura: Stored XSS via markdown HTML processing",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-80180",
    "datePublished": "2026-09-04T06:50:14.773Z",
    "dateReserved": "2026-08-25T21:16:43.696Z",
    "dateUpdated": "2026-09-04T19:43:36.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71216 (GCVE-0-2026-71216)

Vulnerability from nvd – Published: 2026-09-04 06:55 – Updated: 2026-09-08 14:40

Title

Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

Summary

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to the socket unencrypted before any redirect response is received. Redirection affects only whether the request is retried securely, not whether the first copy left the host in the clear. This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0. Users are recommended to upgrade to version 11.0.0, which fixes the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 14:40 UTC

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ktfk9p59p89lqk4zd…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/04/1

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache SkyWalking	Affected: 9.6.0 , ≤ 11.0.0 (semver)

Credits

ambesh.infosec@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T07:11:16.372Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/04/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-71216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:40:25.719618Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T14:40:32.188Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache SkyWalking",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0",
              "status": "affected",
              "version": "9.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ambesh.infosec@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003ePagerDuty alarm hook transmits the integration routing key over cleartext HTTP.\u003c/span\u003e\u003c/p\u003e\u003cp\u003ePagerDuty serves this endpoint over HTTPS and will\u003cbr\u003enormally answer plain HTTP with a redirect. That does not remove the exposure.\u003cbr\u003eThe initial POST -- including the JSON body containing the routing key -- is\u003cbr\u003ewritten to the socket unencrypted before any redirect response is received.\u003cbr\u003eRedirection affects only whether the request is retried securely, not whether\u003cbr\u003ethe first copy left the host in the clear.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache SkyWalking: from 9.6.0 through 11.0.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "PagerDuty alarm hook transmits the integration routing key over cleartext HTTP.\n\n\n\nPagerDuty serves this endpoint over HTTPS and will\nnormally answer plain HTTP with a redirect. That does not remove the exposure.\nThe initial POST -- including the JSON body containing the routing key -- is\nwritten to the socket unencrypted before any redirect response is received.\nRedirection affects only whether the request is retried securely, not whether\nthe first copy left the host in the clear.\n\n\n\nThis issue affects Apache SkyWalking: from 9.6.0 through 11.0.0.\n\n\n\nUsers are recommended to upgrade to version 11.0.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T06:55:59.485Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ktfk9p59p89lqk4zdq0twk6nj6ssnsfk"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-71216",
    "datePublished": "2026-09-04T06:55:59.485Z",
    "dateReserved": "2026-08-05T07:46:34.741Z",
    "dateUpdated": "2026-09-08T14:40:32.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74761 (GCVE-0-2026-74761)

Vulnerability from cvelistv5 – Published: 2026-09-09 11:10 – Updated: 2026-09-09 11:11

Title

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Summary

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Severity

No CVSS data available.

CWE

CWE-20 - Improper Input Validation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/n9md06jo7ccqmj2mn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

3 products

Vendor	Product	Version
Apache Software Foundation	Apache ActiveMQ Broker	Affected: 6.0.0 , < 6.3.2 (semver) Affected: 0 , < 5.19.11 (semver)
Apache Software Foundation	Apache ActiveMQ All	Affected: 6.0.0 , < 6.3.2 (semver) Affected: 0 , < 5.19.11 (semver)
Apache Software Foundation	Apache ActiveMQ	Affected: 6.0.0 , < 6.3.2 (semver) Affected: 0 , < 5.19.11 (semver)

Credits

Wanxin Yin (yaklang.io)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:11:01.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-broker",
          "product": "Apache ActiveMQ Broker",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.3.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-all",
          "product": "Apache ActiveMQ All",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.3.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.3.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wanxin Yin (yaklang.io)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All\u0026nbsp;on all platforms.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAn authenticated client can spoof clientId when removing a durable topic subscription.\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All\u00a0on all platforms.\n\n\n\n\nAn authenticated client can spoof clientId when removing a durable topic subscription.\n\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.\n\n\n\nUsers are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T11:10:16.065Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-74761",
    "datePublished": "2026-09-09T11:10:16.065Z",
    "dateReserved": "2026-08-15T13:53:34.221Z",
    "dateUpdated": "2026-09-09T11:11:01.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73334 (GCVE-0-2026-73334)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:48 – Updated: 2026-09-09 11:10

Title

Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Summary

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.

Severity

No CVSS data available.

CWE

CWE-20 - Improper Input Validation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ro2vomk9xxhv34xhv…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Parquet Hadoop	Affected: 1.12 , ≤ 1.18.0 (custom)

Credits

n0mi1k

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:59.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.parquet.crypto.keytools:parquet-hadoop",
          "packageURL": "pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop",
          "product": "Apache Parquet Hadoop",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.18.0",
              "status": "affected",
              "version": "1.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Potential problem for users of the\u0026nbsp;org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \u003cbr\u003eThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u0026nbsp;\u003cbr\u003eOn the reader side, the KMS URL can be application-controlled or file-controlled.\u003cbr\u003e\u003cspan\u003eIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \u003cbr\u003eIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003eBefore the problem is fixed, users are recommended to\u0026nbsp;leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\u003cbr\u003eAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u0026nbsp;\u003cbr\u003ewill have two options then:\u0026nbsp;leverage application control for KMS URL parameter in readers, or enable file-controlled\u0026nbsp;KMS URL (via a new app parameter).\u003cbr\u003eThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."
            }
          ],
          "value": "Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:48:46.250Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-73334",
    "datePublished": "2026-09-09T10:48:46.250Z",
    "dateReserved": "2026-08-12T06:00:31.756Z",
    "dateUpdated": "2026-09-09T11:10:59.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41871 (GCVE-0-2026-41871)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:45 – Updated: 2026-09-09 11:10

Title

Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/rbr63fx8vlrhzrfkn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Nutch	Affected: 1.10 , ≤ 1.22 (custom)

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:19.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u0026nbsp;in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.10 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:45:47.005Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41871",
    "datePublished": "2026-09-09T10:45:47.005Z",
    "dateReserved": "2026-04-22T06:35:10.384Z",
    "dateUpdated": "2026-09-09T11:10:19.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41869 (GCVE-0-2026-41869)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:44 – Updated: 2026-09-09 11:10

Title

Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-404 - Improper Resource Shutdown or Release

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ps4yhlvo6kdgmksdg…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/3

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Nutch	Affected: 1.10 , ≤ 1.22 (custom)

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:14.888Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.10 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404 Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:44:30.167Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41869",
    "datePublished": "2026-09-09T10:44:30.167Z",
    "dateReserved": "2026-04-22T06:29:48.621Z",
    "dateUpdated": "2026-09-09T11:10:14.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41870 (GCVE-0-2026-41870)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:43 – Updated: 2026-09-09 11:10

Title

Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-913 - Improper Control of Dynamically-Managed Code Resources
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/3pl59g0jzqx1bdh5w…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/4

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Nutch	Affected: 1.11 , ≤ 1.22 (custom)

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:16.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Improper Control of Generation of Code (\u0027Code Injection\u0027), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u0026nbsp;in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.11 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Improper Control of Generation of Code (\u0027Code Injection\u0027), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.11 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:43:04.894Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/3pl59g0jzqx1bdh5w92qoftzn7c3x8j2"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165",
          "NUTCH-3168"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41870",
    "datePublished": "2026-09-09T10:43:04.894Z",
    "dateReserved": "2026-04-22T06:33:41.605Z",
    "dateUpdated": "2026-09-09T11:10:16.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65181 (GCVE-0-2026-65181)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:40 – Updated: 2026-09-09 11:10

Title

Apache Impala: RCE via External Data Source Class Loading

Summary

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-913 - Improper Control of Dynamically-Managed Code Resources

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/2ty3srsh96j86xxg4…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 2.7.0 , ≤ 4.5.1 (semver)

Credits

zhaokaifei ChinaTelecom

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:57.722Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/24"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zhaokaifei ChinaTelecom"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.\u003cbr\u003eUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
            }
          ],
          "value": "Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:40:51.317Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2ty3srsh96j86xxg4g1hbo5rwvszwcnl"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Impala: RCE via External Data Source Class Loading",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-65181",
    "datePublished": "2026-09-09T10:40:51.317Z",
    "dateReserved": "2026-07-21T18:05:06.002Z",
    "dateUpdated": "2026-09-09T11:10:57.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57866 (GCVE-0-2026-57866)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:39 – Updated: 2026-09-09 11:10

Title

Apache Impala: Secrets Exfiltration via SSRF

Summary

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.

Severity

No CVSS data available.

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/nnk4660cbs6dmmkch…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 4.4.0 , ≤ 4.5.1 (semver)

Credits

Andrey Rukin (Arenadata)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:47.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/23"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrey Rukin (Arenadata)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.\u0026nbsp; Authenticated Impala users with permissions to execute the\u0026nbsp;\u003cspan\u003e\u003cspan\u003eai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `\u003ccode\u003ehadoop.security.credential.provider.path` property of `\u003c/code\u003ecore-site.xml`. The secret\u0027s key must be known to the user.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.\u00a0 Authenticated Impala users with permissions to execute the\u00a0ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret\u0027s key must be known to the user."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:39:47.244Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/nnk4660cbs6dmmkch7ch7wwb3g9myw7j"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Impala: Secrets Exfiltration via SSRF",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-57866",
    "datePublished": "2026-09-09T10:39:47.244Z",
    "dateReserved": "2026-06-25T21:30:09.873Z",
    "dateUpdated": "2026-09-09T11:10:47.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56207 (GCVE-0-2026-56207)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:36 – Updated: 2026-09-09 11:10

Title

Apache Impala: SAML authentication bypass via forged bearer token

Summary

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/20cov78py0zqzx7dy…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 4.0.0 , ≤ 4.5.1 (semver)

Credits

Andrew Rukin (Arenadata)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:45.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/22"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrew Rukin (Arenadata)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSignature of Bearer token is not verified in last step of SAML2 authentication for Impala\u0027s hs2-http interface, allowing altering user name and acting as another user.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Impala: \u0026gt;=4.0.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 4.5.2, which fixes this issue.\u003c/p\u003e"
            }
          ],
          "value": "Signature of Bearer token is not verified in last step of SAML2 authentication for Impala\u0027s hs2-http interface, allowing altering user name and acting as another user.\n\n\n\nThis issue affects Apache Impala: \u003e=4.0.0.\n\n\n\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:36:55.238Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/20cov78py0zqzx7dyq39ktythkwn91zs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Impala: SAML authentication bypass via forged bearer token",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-56207",
    "datePublished": "2026-09-09T10:36:55.238Z",
    "dateReserved": "2026-06-19T15:49:57.313Z",
    "dateUpdated": "2026-09-09T11:10:45.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54048 (GCVE-0-2026-54048)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:34 – Updated: 2026-09-09 11:10

Title

Apache Impala: Avro Schema URL Server-Side Request Forgery

Summary

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/cn3q4s8yx924ndlm3…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Impala	Affected: 2.0.0 , ≤ 4.5.1 (semver)

Credits

zhaokaifei ChinaTelecom

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:35.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Impala",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.5.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zhaokaifei ChinaTelecom"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Specifying tblproperties(\u0027avro.schema.url\u0027=\u0027\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://...\u0027\"\u003ehttp://...\u0027\u003c/a\u003e) or with a \u0027file:///\u0027 URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.\u003cbr\u003eUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
            }
          ],
          "value": "Specifying tblproperties(\u0027avro.schema.url\u0027=\u0027 http://...\u0027 ) or with a \u0027file:///\u0027 URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:34:01.432Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Impala: Avro Schema URL Server-Side Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-54048",
    "datePublished": "2026-09-09T10:34:01.432Z",
    "dateReserved": "2026-06-11T17:21:18.283Z",
    "dateUpdated": "2026-09-09T11:10:35.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75156 (GCVE-0-2026-75156)

Vulnerability from cvelistv5 – Published: 2026-09-08 16:47 – Updated: 2026-09-08 19:00

Title

Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

Summary

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:59 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

apache mitre root

References

3 references

URL	Tags
https://github.com/apache/airflow/pull/71735	patch
https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l…	vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-59243	related

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Airflow FAB provider	Affected: 3.7.3 , < 3.8.1 (semver)

Credits

Roberto Nunes NEO AI Engineer (@neo-ai-engineer, ProjectDiscovery) Jarek Potiuk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-75156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:59:35.794768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T19:00:04.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-fab",
          "product": "Apache Airflow FAB provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.8.1",
              "status": "affected",
              "version": "3.7.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Roberto Nunes"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "NEO AI Engineer (@neo-ai-engineer, ProjectDiscovery)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jarek Potiuk"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft\u0026#x27;s **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant \u2014 including one the attacker creates \u2014 passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment.\u003cbr\u003e\u003cbr\u003eThe fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** \u2014 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later."
            }
          ],
          "value": "Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft\u0027s **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant \u2014 including one the attacker creates \u2014 passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment.\n\nThe fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** \u2014 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T16:47:48.290Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/71735"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59243"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated \u2014 cross-tenant authentication bypass",
      "x_generator": {
        "engine": "airflow-s/generate_cve_json.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-75156",
    "datePublished": "2026-09-08T16:47:48.290Z",
    "dateReserved": "2026-08-17T18:58:02.812Z",
    "dateUpdated": "2026-09-08T19:00:04.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78254 (GCVE-0-2026-78254)

Vulnerability from cvelistv5 – Published: 2026-09-07 07:41 – Updated: 2026-09-08 15:45

Title

Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

Summary

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:44 UTC

CWE

CWE-23 - Relative path traversal

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/05s46qrlbhd06c6rs…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/06/2

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Ant	Affected: 1.2 , < 1.10.18 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-07T08:16:01.151Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/06/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78254",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:44:47.827022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:45:11.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.ant:ant",
          "product": "Apache Ant",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.10.18",
              "status": "affected",
              "version": "1.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker\u0027s choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. \u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eIn order to exploit this vulnerability, the server would either have to be malicious\u0026nbsp;or be subject to a machine-in-the-middle attack. Additionally\u0026nbsp;in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eFor ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eStarting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the  old behavior is required by existing build files.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eMitigations:\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003eAll users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue."
            }
          ],
          "value": "The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker\u0027s choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. \n\n\n\n\nIn order to exploit this vulnerability, the server would either have to be malicious\u00a0or be subject to a machine-in-the-middle attack. Additionally\u00a0in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.\n\n\n\n\nFor ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.\n\n\n\n\nStarting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the  old behavior is required by existing build files.\n\n\n\n\nMitigations:\n\n\n\n\nUsers of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.\n\n\n\n\nAll users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative path traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T07:41:54.077Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/05s46qrlbhd06c6rsgvxh8zo0l4p9scz"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-78254",
    "datePublished": "2026-09-07T07:41:54.077Z",
    "dateReserved": "2026-08-24T07:17:27.205Z",
    "dateUpdated": "2026-09-08T15:45:11.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52691 (GCVE-0-2026-52691)

Vulnerability from cvelistv5 – Published: 2026-09-04 13:39 – Updated: 2026-09-08 18:55 Unsupported When Assigned

Title

Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module

Summary

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:55 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/ocjolvzl804qlkto2…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/04/4

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Griffin Hive Metastore Module	Affected: 0 , ≤ * (semver)

Credits

Firebasky ( https://github.com/firebasky )

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-04T15:07:20.498Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/04/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-52691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:55:17.598906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:55:35.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.griffin:service",
          "product": "Apache Griffin Hive Metastore Module",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Firebasky ( https://github.com/firebasky )"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Apache Griffin Hive Metastore Module.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis issue affects Apache Griffin Hive Metastore Module: all versions.\u003c/p\u003e\u003cp\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\u003c/p\u003e\u003cp\u003eNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Apache Griffin Hive Metastore Module.\u00a0\n\n\n\nThis issue affects Apache Griffin Hive Metastore Module: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T13:39:10.779Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ocjolvzl804qlkto2vx685f8o23vxxlo"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-52691",
    "datePublished": "2026-09-04T13:39:10.779Z",
    "dateReserved": "2026-06-08T09:04:24.173Z",
    "dateUpdated": "2026-09-08T18:55:35.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

4578 vulnerabilities by Apache Software Foundation

CVE-2026-74761 (GCVE-0-2026-74761)

CVE-2026-73334 (GCVE-0-2026-73334)

CVE-2026-65181 (GCVE-0-2026-65181)

CVE-2026-57866 (GCVE-0-2026-57866)

CVE-2026-56207 (GCVE-0-2026-56207)

CVE-2026-54048 (GCVE-0-2026-54048)

CVE-2026-41871 (GCVE-0-2026-41871)

CVE-2026-41870 (GCVE-0-2026-41870)

CVE-2026-41869 (GCVE-0-2026-41869)

CVE-2026-75156 (GCVE-0-2026-75156)

CVE-2026-78254 (GCVE-0-2026-78254)

CVE-2026-52691 (GCVE-0-2026-52691)

CVE-2026-85229 (GCVE-0-2026-85229)

CVE-2026-80190 (GCVE-0-2026-80190)

CVE-2026-81270 (GCVE-0-2026-81270)

CVE-2026-80181 (GCVE-0-2026-80181)

CVE-2026-80180 (GCVE-0-2026-80180)

CVE-2026-71216 (GCVE-0-2026-71216)

CVE-2026-74761 (GCVE-0-2026-74761)

CVE-2026-73334 (GCVE-0-2026-73334)

CVE-2026-41871 (GCVE-0-2026-41871)

CVE-2026-41869 (GCVE-0-2026-41869)

CVE-2026-41870 (GCVE-0-2026-41870)

CVE-2026-65181 (GCVE-0-2026-65181)

CVE-2026-57866 (GCVE-0-2026-57866)

CVE-2026-56207 (GCVE-0-2026-56207)

CVE-2026-54048 (GCVE-0-2026-54048)

CVE-2026-75156 (GCVE-0-2026-75156)

CVE-2026-78254 (GCVE-0-2026-78254)

CVE-2026-52691 (GCVE-0-2026-52691)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

4578 vulnerabilities by Apache Software Foundation

CVE-2026-74761 (GCVE-0-2026-74761)

CVE-2026-73334 (GCVE-0-2026-73334)

CVE-2026-65181 (GCVE-0-2026-65181)

CVE-2026-57866 (GCVE-0-2026-57866)

CVE-2026-56207 (GCVE-0-2026-56207)

CVE-2026-54048 (GCVE-0-2026-54048)

CVE-2026-41871 (GCVE-0-2026-41871)

CVE-2026-41870 (GCVE-0-2026-41870)

CVE-2026-41869 (GCVE-0-2026-41869)

CVE-2026-75156 (GCVE-0-2026-75156)

CVE-2026-78254 (GCVE-0-2026-78254)

CVE-2026-52691 (GCVE-0-2026-52691)

CVE-2026-85229 (GCVE-0-2026-85229)

CVE-2026-80190 (GCVE-0-2026-80190)

CVE-2026-81270 (GCVE-0-2026-81270)

CVE-2026-80181 (GCVE-0-2026-80181)

CVE-2026-80180 (GCVE-0-2026-80180)

CVE-2026-71216 (GCVE-0-2026-71216)

CVE-2026-74761 (GCVE-0-2026-74761)

CVE-2026-73334 (GCVE-0-2026-73334)

CVE-2026-41871 (GCVE-0-2026-41871)

CVE-2026-41869 (GCVE-0-2026-41869)

CVE-2026-41870 (GCVE-0-2026-41870)

CVE-2026-65181 (GCVE-0-2026-65181)

CVE-2026-57866 (GCVE-0-2026-57866)

CVE-2026-56207 (GCVE-0-2026-56207)

CVE-2026-54048 (GCVE-0-2026-54048)

CVE-2026-75156 (GCVE-0-2026-75156)

CVE-2026-78254 (GCVE-0-2026-78254)

CVE-2026-52691 (GCVE-0-2026-52691)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.