Apache Software Foundation vulnerabilities and threats

An incorrect authorization vulnerability in Apache DolphinScheduler allows users with limited permissions to access workflow instance information from projects they should not have access to. This issue affects versions prior to 3.4.2. The vulnerability has a medium severity rating with a CVSS score of 6.5. Upgrading to version 3.4.2 resolves the issue.

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

An authorization flaw in Apache DolphinScheduler before version 3.4.2 allows unauthorized users to access arbitrary data source metadata via the DataSource API. This vulnerability is identified as CWE-863 Incorrect Authorization. The issue is fixed in version 3.4.2.

A critical path traversal vulnerability (CWE-22) exists in Apache Airflow SFTP provider versions prior to 5.8.1. This vulnerability allows a malicious or compromised remote SFTP server to write files outside the intended local directory by using crafted directory-entry names. Exploitation does not require any Airflow account, making any deployment that downloads directories from an untrusted SFTP server vulnerable. Upgrading to version 5.8.1 or later mitigates this issue.

CVE-2026-50632 is a high-severity vulnerability in Apache CXF related to improper input validation and deserialization of untrusted JMS configuration data. It stems from an incomplete fix of a previous issue (CVE-2026-44417) and allows untrusted users who can configure JMS to achieve arbitrary code execution, potentially leading to full system compromise. The vulnerability affects multiple Apache CXF versions prior to fixed releases 4.2.2, 4.1.7, and 3.6.12. Mitigation involves restricting JMS configuration access to trusted administrators only. Official patches are available in the specified fixed versions.

CVE-2026-49875 is an information disclosure vulnerability in Apache CXF caused by improper XML parser configuration that allows out-of-band external entity resolution. This flaw affects the EndpointReferenceUtils and W3CMultiSchemaFactory classes, enabling remote attackers to disclose sensitive information without user interaction. The vulnerability is addressed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Red Hat products bundling Apache CXF are also affected, but currently no effective mitigation or fix meeting Red Hat's criteria is available for those products.

Apache CXF versions prior to 4.1.7, 4.2.2, and 3.6.12 allow an unlimited number of attachment headers during message deserialization. This lack of restriction can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions. The issue is addressed by imposing a default maximum of 500 attachments per message in the fixed versions.

CVE-2026-50634 is a medium severity vulnerability in Apache CXF affecting the JwsJsonContainerRequestFilter component. It allows processing of metadata that was not authenticated by the accepted cryptographic signature, potentially bypassing the application's trust assumptions about signed HTTP headers or content types. This could affect downstream entity parsing or signed-header consistency checks. Fixed versions include Apache CXF 4.2.2, 4.1.7, and 3.6.12.

CVE-2026-50633 is a high-severity JNDI Injection vulnerability in Apache CXF's JCA integration module that allows arbitrary code execution if an attacker can manipulate the JCA deployment descriptor or runtime activation parameters. The vulnerability affects multiple versions of Apache CXF prior to 4.1.7, 4.2.2, and 3.6.12. The attack complexity is high, requiring specific conditions for exploitation. Red Hat products shipping Apache CXF are affected, but no effective mitigation is currently available that meets Red Hat's criteria. Users are recommended to upgrade to fixed versions to remediate the issue.

CVE-2026-50631 is a high-severity race condition vulnerability in Apache CXF's AbstractOAuthDataProvider. It allows concurrent requests using the same refresh token to bypass single-use restrictions and generate multiple valid access tokens when 'recycleRefreshTokens' is set to false. This flaw can enable attackers to replay a leaked refresh token concurrently, potentially compromising access control. Fixed versions include 4.2.2, 4.1.7, and 3.6.12.

CVE-2026-50630 is a CRLF injection vulnerability in Apache CXF's OAuth2 AuthorizationUtils class. The vulnerability occurs because the 'realm' parameter in the WWW-Authenticate response header is concatenated without sanitizing carriage return and line feed characters. This allows an attacker controlling the realm value to inject arbitrary HTTP headers or split the HTTP response. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.

CVE-2026-50629 is a medium severity vulnerability in Apache CXF where the 'clientId' parameter from HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This improper neutralization of CRLF sequences allows attackers to inject arbitrary content, including fake log entries, into server logs. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVE-2026-50623 is an authentication bypass vulnerability in Apache CXF's OAuth2 TokenIntrospectionService. The flaw is due to a missing 'throw' keyword in the security context check, allowing unauthenticated access to the introspection endpoint if authentication is not enabled. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. The vulnerability has a medium severity with a CVSS score of 4.8.

CVE-2026-47342 is a privilege escalation vulnerability in Apache OFBiz that allows a low-privileged authenticated user to gain higher privileges. The issue affects versions of Apache OFBiz before 24.09.07. Users are advised to upgrade to version 24.09.07, which addresses this vulnerability.

CVE-2026-50223 is a high-severity code injection vulnerability in Apache OFBiz that allows a low-privileged authenticated user with Content/DataResource editing rights to perform template injection attacks potentially leading to remote code execution. The vulnerability affects versions of Apache OFBiz before 24.09.07. Users are advised to upgrade to version 24.09.07, which addresses this issue.

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.