Apache SeaTunnel 3.0.0 Remote Code Execution

Apache SeaTunnel versions 3.0.0 and 2.3.13 contain an unauthenticated remote code execution issue in the engine REST API DynamicCompile transform. !/usr/bin/env python Apache SeaTunnel 3.0.0 Remote Code Execution Vendor: The Apache Software Foundation Product web page: https://seatunnel.apache.or...

Apache SeaTunnel 3.0.0 Remote Code Execution

Summary SeaTunnel is a very easy-to-use, ultra-high-performance, distributed data integration platform that supports real-time synchronization of massive data. It can synchronize tens of billions of data stably and efficiently every day, and has been used in production by nearly 100 companies...

CVE-2023-49198

Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true=true=/=655360 This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue...

EUVD-2025-18684

Malicious code in bioql PyPI...

EUVD-2024-2326

Malicious code in bioql PyPI...

Missing Authentication For Critical Function

Apache SeaTunnel is vulnerable to Missing Authentication For Critical Function. The vulnerability is due to insufficient access control and improper input validation due to unauthorized access to the /hazelcast/rest/maps/submit-job endpoint, allowing attackers to exploit the MySQL URL parameters...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

GHSA-9X53-GR7P-4QF5 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10), org.apache.seatunnel:connector-seatunnel-e2e-base (>=2.3.0, <=2.3.10) +2 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-server (>=2.3.0, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-server MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.4, =2.3.10 Source cves: CVE-2025-32896 Source advisory: OSV:GHSA-9X53-GR7P-4QF5...

org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10), org.apache.seatunnel:connector-seatunnel-e2e-base (>=2.3.0, <=2.3.10) +2 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-server (>=2.3.0, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-server MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.4, =2.3.10 Source cves: CVE-2025-32896 Source advisory: SNYK:JAVA-ORGAPACHESEATUNNEL-10442152...

org.apache.linkis:linkis-engineplugin-seatunnel (>=1.4.0, <=1.8.0), org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10) +7 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-common (>=2.3.0-beta, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-common MAVEN version =2.3.0-beta, =1.4.0, =2.3.0, =2.3.0, =1.0.0, =2.3.0-beta, =2.3.0-beta, =2.3.0, =2.3.4, =2.3.0-beta, =2.3.10 Source cves: CVE-2025-32896 Source advisory: OSV:GHSA-9X53-GR7P-4QF5...

org.apache.linkis:linkis-engineplugin-seatunnel (>=1.4.0, <=1.8.0), org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10) +7 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-common (>=2.3.0-beta, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-common MAVEN version =2.3.0-beta, =1.4.0, =2.3.0, =2.3.0, =1.0.0, =2.3.0-beta, =2.3.0-beta, =2.3.0, =2.3.4, =2.3.0-beta, =2.3.10 Source cves: CVE-2025-32896 Source advisory: SNYK:JAVA-ORGAPACHESEATUNNEL-10442151...

Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10), org.apache.seatunnel:connector-seatunnel-e2e-base (>=2.3.0, <=2.3.10) +2 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-server (>=2.3.0, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-server MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.4, =2.3.10 Source cves: CVE-2025-32896 Source advisory: GHSA-9X53-GR7P-4QF5...

org.apache.linkis:linkis-engineplugin-seatunnel (>=1.4.0, <=1.8.0), org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10) +7 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-common (>=2.3.0-beta, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-common MAVEN version =2.3.0-beta, =1.4.0, =2.3.0, =2.3.0, =1.0.0, =2.3.0-beta, =2.3.0-beta, =2.3.0, =2.3.4, =2.3.0-beta, =2.3.10 Source cves: CVE-2025-32896 Source advisory: GHSA-9X53-GR7P-4QF5...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

org.apache.seatunnel:connector-console-seatunnel-e2e (>=2.3.0, <=2.3.10), org.apache.seatunnel:connector-seatunnel-e2e-base (>=2.3.0, <=2.3.10) +2 more potentially affected by CVE-2025-32896 via org.apache.seatunnel:seatunnel-engine-server (>=2.3.0, <=2.3.10)

org.apache.seatunnel:seatunnel-engine-server MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.4, =2.3.10 Source cves: CVE-2025-32896 Source advisory: MEND:CVE-2025-32896...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access "/hazelcast/rest/maps/submit-job" to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...