Apache Seatunnel vulnerabilities

3 CVEs affecting Apache Seatunnel, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-32896, published 2025-06-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-32896, published 2025-06-19. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job`…
CVE-2023-49198, published 2024-08-21. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL …
CVE-2023-48396, published 2024-07-30. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key…