CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2025-32896
Medium (6.5) in apache seatunnel. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.apache.seatunnel:seatunnel-engine-server 2.3.11.
# Summary
Unauthorized users can perform Arbitrary File Read and Deserialization
attack by submit job using restful api-v1.
# Details
Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit
job.
An attacker can set extra params in mysql url to perform Arbitrary File
Read and Deserialization attack.
This issue affects Apache SeaTunnel: <=2.3.10
# Fixed
Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:seatunnel
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9x53-gr7p-4qf5 | Maven | org.apache.seatunnel:seatunnel-engine-server | <2.3.11 | 2.3.11 |
| GHSA-9x53-gr7p-4qf5 | Maven | org.apache.seatunnel:seatunnel-engine-common | <2.3.11 | 2.3.11 |