CVE-2025-32896

MEDIUM

Apache Seatunnel < 2.3.11 - Missing Authentication

Title source: rule

Description

# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

References (3)

Scores

CVSS v3 6.5
EPSS 0.0019
EPSS Percentile 40.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-306
Status published

Affected Products (3)

apache/seatunnel < 2.3.11
org.apache.seatunnel/seatunnel-engine-server < 2.3.11Maven
org.apache.seatunnel/seatunnel-engine-common < 2.3.11Maven

Timeline

Published Jun 19, 2025
Tracked Since Feb 18, 2026