CVE-2023-48396

Apache SeaTunnel version 1.0.0 is vulnerable to a Web Authentication bypass (CWE-290) due to a hardcoded JWT key in the application. An attacker can retrieve the secret key from /seatunnel-server/seatunnel-app/src/main/resources/application.yml to forge tokens and gain unauthorized access as any ...

CVE-2025-32896

Apache SeaTunnel versions

CVE-2023-49198

CVE-2023-49198 : Arbitrary file read in Apache SeaTunnel Web due to MySQL URL parameters (allowLoadLocalInfile, allowUrlInLocalInfile, allowLoadLocalInfileInPath, maxAllowedPacket). Affected: SeaTunnel 1.0.0; fix: upgrade to 1.0.1. Multiple connected sources corroborate the issue and remediation;...