What is GHSA-9x53-gr7p-4qf5?

GHSA-9x53-gr7p-4qf5 is a security advisory published by GitHub Security Advisories with Low severity. Apache SeaTunnel: Unauthenticated insecure access

Which CVE IDs does GHSA-9x53-gr7p-4qf5 cover?

GHSA-9x53-gr7p-4qf5 covers the following CVE IDs: CVE-2025-32896. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9x53-gr7p-4qf5?

GHSA-9x53-gr7p-4qf5 affects 2 products, including: maven/org.apache.seatunnel:seatunnel-engine-server:\u003c 2.3.11; maven/org.apache.seatunnel:seatunnel-engine-common:\u003c 2.3.11.

GHSA-9x53-gr7p-4qf5Low

Apache SeaTunnel: Unauthenticated insecure access

Vendor

GitHub Security Advisories

Published

June 19, 2025

Last Modified

June 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-32896 →

📋 Description

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

🎯 Affected products2

maven/org.apache.seatunnel:seatunnel-engine-server:< 2.3.11
maven/org.apache.seatunnel:seatunnel-engine-common:< 2.3.11

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-32896
https://github.com/apache/seatunnel/pull/9010
https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9
http://www.openwall.com/lists/oss-security/2025/04/12/1
https://github.com/apache/seatunnel/commit/53325aa3e76e3939f41a4bf3eaaf3ee56f13f311
https://github.com/advisories/GHSA-9x53-gr7p-4qf5