CVE-2023-49198

Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true=true=/=655360 This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue...

EUVD-2024-2326

Malicious code in bioql PyPI...

EUVD-2025-18684

Malicious code in bioql PyPI...

Missing Authentication For Critical Function

Apache SeaTunnel is vulnerable to Missing Authentication For Critical Function. The vulnerability is due to insufficient access control and improper input validation due to unauthorized access to the /hazelcast/rest/maps/submit-job endpoint, allowing attackers to exploit the MySQL URL parameters...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

GHSA-9X53-GR7P-4QF5 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

org.apache.linkis:linkis-engineplugin-seatunnel (>=1.4.0 <=1.8.0), org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0 <=2.3.10) +6 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-common (>=2.3.0-beta <=2.3.10)

org.apache.seatunnel:seatunnel-engine-common MAVEN version =2.3.0-beta, =1.4.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.10 Source cves: CVE-2025-32896 Source advisory: OSV:GHSA-9X53-GR7P-4QF5...

org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0 <=2.3.10), org.apache.seatunnel:connector-seatunnel-e2e-base (>=2.3.0 <=2.3.10) +2 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-server (>=2.3.0 <=2.3.10)

org.apache.seatunnel:seatunnel-engine-server MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.10 - org.apache.seatunnel:seatunnel-engine-k8s-e2e =2.3.10 Source cves: CVE-2025-32896 Source advisory: SNYK:JAVA-ORGAPACHESEATUNNEL-10442152...

org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0 <=2.3.10), org.apache.seatunnel:connector-seatunnel-e2e-base (>=2.3.0 <=2.3.10) +2 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-server (>=2.3.0 <=2.3.10)

org.apache.seatunnel:seatunnel-engine-server MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.10 - org.apache.seatunnel:seatunnel-engine-k8s-e2e =2.3.10 Source cves: CVE-2025-32896 Source advisory: OSV:GHSA-9X53-GR7P-4QF5...

org.apache.linkis:linkis-engineplugin-seatunnel (>=1.4.0 <=1.8.0), org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0 <=2.3.10) +6 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-common (>=2.3.0-beta <=2.3.10)

org.apache.seatunnel:seatunnel-engine-common MAVEN version =2.3.0-beta, =1.4.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.10 Source cves: CVE-2025-32896 Source advisory: SNYK:JAVA-ORGAPACHESEATUNNEL-10442151...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896

CVE-2025-32896 affects Apache SeaTunnel (

CVE-2023-48396

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affect...

The vulnerability of the Apache SeaTunnel data processing software lies in its authentication procedures’ deficiencies, which allow attackers to gain unauthorized access to protected information.

The vulnerability of the Apache SeaTunnel data processing platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

PT-2025-16173 · Apache · Apache Seatunnel

Name of the Vulnerable Software and Affected Versions: Apache SeaTunnel versions =2.3.10 Description: Unauthorized users can perform Arbitrary File Read and Deserialization attack by submitting a job using the restful api-v1. An attacker can access the /hazelcast/rest/maps/submit-job endpoint to...

Arbitrary File Read

org.apache.seatunnel, seatunnel-web is vulnerable to Arbitrary File Read. The vulnerability is caused due to a missing validation in the MySQL connection URL using parameters allowLoadLocalInfile, allowLoadLocalInfile , allowUrlInLocalInfile and allowLoadLocalInfileInPath. This can lead to an...