Apache Livy vulnerabilities

3 CVEs affecting Apache Livy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-66249, published 2026-03-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-26544, published 2021-02-20. Medium severity, CVSS 5.4. EPSS: 2.8% chance of exploitation in the next 30 days. Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions…
CVE-2025-66249, published 2026-03-13. Medium severity, CVSS 6.3. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be…
CVE-2025-60012, published 2026-03-13. Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days. Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a…