Apache Submarine 0.8.0 Authentication Bypass / Remote Code Execution

Summary Apache Submarine Submarine for short is an End-to-End Machine Learning Platform to allow data scientists to create end-to-end machine learning workflows. On Submarine, data scientists can finish each stage in the ML model lifecycle, including data exploration, data pipeline creation, mode...

...[ More ]

Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...

com.efluid.oss:efluid-datagate-app (>=3.1.3, <=6.1.5), com.efluid.oss:efluid-datagate-app-cucumber (>=3.1.3, <=6.1.5) +5 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (>=5.0.1, <=5.7.8)

org.pac4j:pac4j-jwt MAVEN version =5.0.1, =3.1.3, =3.1.3, =0.8.0-rc0, =0.8.0-rc0, =2.0.6, =2.2.1, =2.0.6, =2.1.0 Source cves: CVE-2026-29000 Source advisory: SNYK:JAVA-ORGPAC4J-15428218...

com.efluid.oss:efluid-datagate-app (>=3.1.3, <=6.1.5), com.efluid.oss:efluid-datagate-app-cucumber (>=3.1.3, <=6.1.5) +5 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (>=5.0.1, <=5.7.8)

org.pac4j:pac4j-jwt MAVEN version =5.0.1, =3.1.3, =3.1.3, =0.8.0-rc0, =0.8.0-rc0, =2.0.6, =2.2.1, =2.0.6, =2.1.0 Source cves: CVE-2026-29000 Source advisory: MEND:CVE-2026-29000...

‘Narco-Submarine’ Carrying 4 Tons of Cocaine Captured by Mexico's Navy

Following increased surveillance and patrols of routes used by transnational drug-trafficking networks, Mexican authorities have seized approximately 10 tons of cocaine in the past week alone...

Unsafe Deserialization

Apache Submarine is vulnerable to unsafe deserialization. The vulnerability is due to insecure YAML deserialization through the SnakeYAML library in the YamlEntityProvider component, which allows an attacker to supply malicious YAML payloads via REST API requests and potentially execute arbitrary...

EUVD-2024-2174

Malicious code in bioql PyPI...

EUVD-2024-0016

Malicious code in bioql PyPI...

EUVD-2023-0042

Malicious code in bioql PyPI...

EUVD-2024-0015

Malicious code in bioql PyPI...

Multichannel Hybrid Quantum Cryptography for Submarine Optical Communications

We present a multichannel hybrid quantum cryptography approach intended for submarine quantum optical communications between Alice and Bob separated a distance beyond the current QKD possibilities, each located on a coastline. It is based on the difficult of a simultaneous access to $M$ optical...

CVE-2024-36264

UNSUPPORTED WHEN ASSIGNED Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set submarine.auth.default.secret, a default value will be used. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not...

CVE-2024-36265

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or...

CVE-2024-36263

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes thi...

org.apache.hive:hive-llap-client (2.3.6), org.apache.hive:hive-llap-tez (2.3.6) +5 more potentially affected by CVE-2024-23953 via org.apache.hive:hive-llap-common (2.3.6)

org.apache.hive:hive-llap-common MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-llap-common and may be impacted: - org.apache.hive:hive-llap-client 2.3.6 - org.apache.hive:hive-llap-tez 2.3.6 -...

SQL Injection

org.apache.submarine: submarine-server-core is vulnerable to SQL Injection. The vulnerability is due to improper neutralization of special elements used in an SQL command, allowing attackers to manipulate queries and potentially gain unauthorized access to the server's database...

org.apache.submarine:submarine-submitter-k8s (0.8.0), org.apache.submarine:submarine-test-k8s (0.8.0) potentially affected by CVE-2024-36265 via org.apache.submarine:submarine-server-core (0.8.0)

org.apache.submarine:submarine-server-core MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.submarine:submarine-server-core and may be impacted: - org.apache.submarine:submarine-submitter-k8s 0.8.0 -...

org.apache.submarine:submarine-submitter-k8s (0.8.0), org.apache.submarine:submarine-test-k8s (0.8.0) potentially affected by CVE-2024-36265 via org.apache.submarine:submarine-server-core (0.8.0)

org.apache.submarine:submarine-server-core MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.submarine:submarine-server-core and may be impacted: - org.apache.submarine:submarine-submitter-k8s 0.8.0 -...

Apache Submarine Server Core Incorrect Authorization vulnerability

Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instanc...

Apache Submarine Server Core has a SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are...