CVE-2024-27348

CVE-2024-27348 (Apache HugeGraph-Server) is an improper access control vulnerability in the Gremlin interface that enables remote code execution. Affected: HugeGraph-Server versions from 1.0.0 up to (but not including) 1.3.0, running on Java 8 or Java 11. Root cause: insufficient access controls ...

CVE-2024-43441

Apache HugeGraph-Server versions prior to 1.5.0 are vulnerable to an authentication bypass caused by assumed-immutable data being improperly handled. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction. Successful exploitation m...

CVE-2024-27349

The Apache HugeGraph-Server is vulnerable to an Authentication Bypass by Spoofing vulnerability (CWE-290). This flaw exists in versions 1.0.0 through 1.2.x due to insufficient authentication checks, which allow an attacker to bypass whitelisting by sending specially crafted requests in authentica...

CVE-2025-26866

Apache HugeGraph-Server is vulnerable to remote code execution (RCE) due to insecure Hessian deserialization within the PD store . An attacker can exploit this by using a malicious Raft node to perform object injection attacks . To remediate this vulnerability, users are recommended to upgrade to...