Apache Spark UI can allow impersonation if ACLs enabled
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.3ECOSYSTEM: introduced 3.2.0; fixed 3.2.2ECOSYSTEM: introduced 0; fixed 3.1.3; introduced 3.2.0; fixed 3.2.2Fixed versions: 3.1.3, 3.2.2
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
4.2.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
12 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-329j-jfvr-rhr6 critical
Apache Spark vulnerable to Improper Privilege Management
Affected range
ECOSYSTEM: introduced 0; fixed 3.3.2ECOSYSTEM: introduced 0; fixed 3.4.0Fixed versions: 3.3.2, 3.4.0
GHSA-wgx7-jwwm-cgjv critical
Improper Authentication in Apache Spark
Affected range
ECOSYSTEM: introduced 0; fixed 2.4.6Fixed versions: 2.4.6
GHSA-59hw-j9g6-mfg3 high
Apache Spark UI vulnerable to Command Injection
Affected range
ECOSYSTEM: introduced 3.1.1; fixed 3.2.2ECOSYSTEM: introduced 0; fixed 3.2.2Fixed versions: 3.2.2
GHSA-8rhc-48pp-52gr high
Apache Spark Deserialization of Untrusted Data vulnerability
Affected range
ECOSYSTEM: introduced 0; fixed 2.1.2Fixed versions: 2.1.2
GHSA-9rr6-jpg7-9jg6 high
Authentication Bypass by Capture-replay in Apache Spark
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.3Fixed versions: 3.1.3
GHSA-fp5j-3fpf-mhj5 high
Sensitive data written to disk unencrypted in Spark
Affected range
ECOSYSTEM: introduced 0; fixed 2.3.3Fixed versions: 2.3.3
PYSEC-2026-3966 moderate
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.5.8Fixed versions: 3.5.8
GHSA-6p6v-m64v-jx8q moderate
Apache Spark has Inadequate Encryption Strength
Affected range
ECOSYSTEM: introduced 0; fixed 3.4.4ECOSYSTEM: introduced 3.5.0; fixed 3.5.2ECOSYSTEM: introduced 0; fixed 3.4.4; introduced 3.5.0; fixed 3.5.2Fixed versions: 3.4.4, 3.5.2
GHSA-43xg-8wmj-cw8h moderate
Apache Spark vulnerable to Log Injection
Affected range
ECOSYSTEM: introduced 0; fixed 3.2.2ECOSYSTEM: introduced 3.3.0; fixed 3.3.1Fixed versions: 3.2.2, 3.3.1
GHSA-fvxv-9xxr-h7wj moderate
Pyspark User Impersonation Vulnerability
Affected range
ECOSYSTEM: introduced 2.3.0; fixed 2.3.2ECOSYSTEM: introduced 1.0.2; fixed 2.2.3ECOSYSTEM: introduced 2.3.0; fixed 2.3.2; introduced 1.0.2; fixed 2.2.3Fixed versions: 2.3.2, 2.2.3
GHSA-6mqq-8r44-vmjc moderate
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark
Affected range
ECOSYSTEM: introduced 2.2.0; fixed 2.2.2ECOSYSTEM: introduced 0; fixed 2.1.3ECOSYSTEM: introduced 2.2.0; fixed 2.2.2; introduced 0; fixed 2.1.3Fixed versions: 2.2.2, 2.1.3