CVE-2017-12622: Apache Geode

High severity, CVSS 7.1. EPSS: 2.1% chance of exploitation in the next 30 days.

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.

Affected products

• Apache Geode: before 1.3.0 (fixed in 1.3.0)

Published 2018-01-10. Last modified 2026-06-17.