CVE-2023-48396

CVE-2023-48396 concerns an authentication bypass in Apache SeaTunnel (v1.0.0). The underlying issue is a hardcoded JWT secret in the application, enabling an attacker to forge tokens and log in as any user. The secret key can be retrieved from the file path shown in the reports (seatunnel-app/src...

CVE-2025-32896

CVE-2025-32896 affects Apache SeaTunnel (

CVE-2023-49198

CVE-2023-49198 : Arbitrary file read in Apache SeaTunnel Web due to MySQL URL parameters (allowLoadLocalInfile, allowUrlInLocalInfile, allowLoadLocalInfileInPath, maxAllowedPacket). Affected: SeaTunnel 1.0.0; fix: upgrade to 1.0.1. Multiple connected sources corroborate the issue and remediation;...