This vulnerability involves unsafe deserialization of untrusted data in Apache Seata (incubating) versions 2.0.0 up to but not including 2.3.0. It specifically impacts the Raft cluster mode, which is optional and not enabled by default. Because Seata operates as internal middleware with communication confined to trusted internal networks, exploitation requires prior unauthorized intranet access. The vulnerability is similar to CVE-2024-47552 but affects a broader version range. The Apache Seata team has assigned a low severity rating based on these real-world mitigating factors. An upgrade to version 2.3.0 is recommended to remediate the issue.

The vulnerability allows for deserialization of untrusted data, which could lead to full compromise (confidentiality, integrity, availability) of affected components in the Raft cluster mode. However, since this mode is optional and not enabled by default, and because the communication occurs only within trusted internal networks, the risk of external exploitation is minimal. No known exploits are reported in the wild. The CVSS score is 9.8 (critical), but the vendor rates the practical severity as low due to the limited attack surface and required attacker capabilities.

Users should upgrade Apache Seata to version 2.3.0 or later, where this vulnerability is fixed. Since the vulnerability only affects the optional Raft cluster mode, disabling this mode if not in use can also mitigate risk. No other specific mitigations are indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 2.3.0.