Apache SeaTunnel: Unauthenticated insecure access
Vulnerability Description
# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32896
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Owen Amadeus
- liyiwei
References
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →