Vulnerability · Published Jun 19, 2025 · Assigned by apache
CVE-2025-32896Apache SeaTunnel: Unauthenticated insecure access
Medium 6.5
In plain English
A medium-severity missing authentication in Apache SeaTunnel from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.seatunnel:seatunnel-engine-common | 2.3.11 | GHSA-9x53-gr7p-4qf5 |
| Maven | org.apache.seatunnel:seatunnel-engine-server | 2.3.11 | GHSA-9x53-gr7p-4qf5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache SeaTunnel | 2.3.1 – through 2.3.10 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N