When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
CVE-2026-57967 is a critical vulnerability in Apache Artemis and Apache ActiveMQ Artemis that allows an unauthenticated remote attacker to steal an existing session by crafting a CORE protocol SESSION_REATTACH packet. This enables the attacker to assume the ongoing execution of a previously authenticated session. The issue affects Apache Artemis versions from 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions from 1.0.0 through 2.44.0. The vulnerability is fixed in version 2.57.0.
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes this issue.
CVE-2026-73334 is a high-severity vulnerability in Apache Parquet Hadoop versions 1.12 through 1.18. It involves improper input validation in the org.apache.parquet.crypto.keytools package, which handles encryption of Parquet files using envelope encryption with a Key Management Service (KMS). The vulnerability arises when the KMS URL parameter is controlled by the file rather than the application, potentially allowing a malicious file to direct KMS tokens to an attacker-controlled host. Users are advised to enforce application control over the KMS URL parameter until the issue is fixed in a future release (presumably version 1.19), which will disable file-controlled KMS URLs by default and require explicit validation and authentication if enabled.
CVE-2026-41871 is a critical vulnerability in Apache Nutch Server's REST API affecting versions 1.10 through 1.22. It involves missing authorization and unsafe reflection, allowing unauthorized access and potentially full compromise. The vulnerability is fixed by upgrading to version 1.23, which removes the vulnerable Nutch Server component. If upgrading is not feasible, restricting access to trusted users is recommended.
Apache Nutch versions 1.10 through 1.22 contain a critical vulnerability involving missing authorization in the Nutch Server REST API. This flaw allows unauthorized access to the service, leading to potential information disclosure and denial of service due to improper resource shutdown and job interruption. The vulnerability is addressed by removing the Nutch Server in version 1.23. Users unable to upgrade should restrict access to trusted users only.
CVE-2026-41870 is a high severity vulnerability in Apache Nutch versions 1.11 through 1.22 affecting the Nutch REST API. It involves missing authorization controls, leading to risks such as code injection, unsafe reflection, and improper control of dynamically managed code resources. The vulnerability allows unauthorized users with limited privileges to potentially execute harmful actions. Apache Nutch 1.23 removes the vulnerable Nutch Server component, mitigating this issue. Users unable to upgrade should restrict access to trusted users only.
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
CVE-2026-57866 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Apache Impala versions 4.4.0 through 4.4.9 and 4.5.0 through 4.5.9. Authenticated users with permission to execute the ai_generate_text() function can exploit this flaw to exfiltrate secrets from credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml, provided they know the secret's key.
CVE-2026-56207 is a critical vulnerability in Apache Impala versions 4.0.0 through 4.5.1 where the signature of the Bearer token is not verified in the final step of SAML2 authentication for the hs2-http interface. This flaw allows an attacker to alter the user name and impersonate another user. The issue is fixed in version 4.5.2.
Apache Impala versions 2.0.0 through 4.5.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an attacker to specify a table property with an avro.schema.url pointing to an HTTP or file URI, causing Impala to issue GET requests to internal endpoints. The responses may be exposed through parsing error messages. The issue is fixed in version 4.5.2.
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment.
The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.
CVE-2026-78254 is a high-severity vulnerability in Apache Ant's ftp and scp tasks that allows a malicious server to perform relative path traversal. This enables writing files outside the intended download directory, potentially overwriting arbitrary files with the permissions of the user running Ant. The vulnerability affects Apache Ant versions from 1.2 up to but not including 1.10.18. Exploitation requires either a malicious server or a man-in-the-middle attack, with additional server identity checks required for scp and ftps. Apache Ant 1.10.18 includes a fix that prevents writing outside the destination directory by default. Users are advised to upgrade to this version and follow recommended mitigations regarding server identity checks and use of ftps.
CVE-2026-52691 is a high severity SQL Injection vulnerability in the Apache Griffin Hive Metastore Module affecting all versions. The vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker with limited privileges to potentially execute arbitrary SQL commands. The project is retired and no fixes will be released. Users are advised to restrict access to trusted users or migrate to alternative solutions.
Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.
This issue affects Apache Allura: through 1.20.0.
Users are recommended to upgrade to version 1.21.0, which fixes the issue.
CVE-2026-85229 is a cross-site scripting (XSS) vulnerability in the Apache SkyWalking Booster UI affecting versions 10.2.0 through 10.4.0. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The issue is resolved by upgrading to Horizon UI 1.0.0.
Apache Allura: exposure of non-public information via search.
This issue affects Apache Allura: through 1.20.0.
Users are recommended to upgrade to version 1.21.0, which fixes the issue.
Apache SkyWalking versions from 9.6.0 through 11.0.0 have a vulnerability where the PagerDuty alarm hook transmits the integration routing key over unencrypted HTTP. Although PagerDuty redirects HTTP requests to HTTPS, the initial POST containing sensitive information is sent in cleartext before the redirect occurs. This exposure could allow interception of the routing key during transmission. Users are advised to upgrade to version 11.0.0 where this issue is fixed.
Apache Allura versions up to 1.20.0 contain a Server-Side Request Forgery (SSRF) vulnerability in its webhook functionality. This vulnerability allows unauthenticated attackers to induce the server to make HTTP requests to arbitrary domains. The issue is fixed in version 1.21.0. The vulnerability has a high severity with a CVSS score of 9.1, indicating critical impact on confidentiality and integrity without requiring user interaction or privileges.