CVE-2025-32896: apache seatunnel

csirt@kutim:~/threat-intel/cve/CVE-2025-32896

CVSS 6.5 · Medium EPSS 1,2%

Kerentanan Missing Authentication for Critical Function pada apache seatunnel. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Rincian

Terbit di NVD: 19 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 66,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	seatunnel	Versi 2.3.1 hingga sebelum 2.3.11

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9 mailing list · advisory vendor
https://github.com/apache/seatunnel/pull/9010 issue tracking · patch
http://www.openwall.com/lists/oss-security/2025/04/12/1 mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.