Apache Streampark vulnerabilities

17 CVEs affecting Apache Streampark, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-53960, published 2025-12-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-49898, published 2023-12-15. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for…
CVE-2023-52291, published 2024-07-17. Medium severity, CVSS 4.7. EPSS: 1.6% chance of exploitation in the next 30 days. In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The…
CVE-2022-46365, published 2023-05-01. Critical severity, CVSS 9.1. EPSS: 1.5% chance of exploitation in the next 30 days. Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name…
CVE-2022-45802, published 2023-05-01. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any…
CVE-2024-29178, published 2024-07-18. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an…
CVE-2024-29737, published 2024-07-17. Medium severity, CVSS 4.7. EPSS: 1.1% chance of exploitation in the next 30 days. In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The…
CVE-2022-45801, published 2023-05-01. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When…
CVE-2023-30867, published 2023-12-15. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from…
CVE-2024-29070, published 2024-07-23. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential.…
CVE-2024-34457, published 2024-07-22. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and…

Latest

CVE-2025-53960, published 2025-12-12. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform…
CVE-2025-54981, published 2025-12-12. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing…
CVE-2025-54947, published 2025-12-12. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for…
CVE-2025-30001, published 2025-10-10. High severity, CVSS 7.3. EPSS: 0.6% chance of exploitation in the next 30 days. Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which…
CVE-2024-48988, published 2025-08-22. High severity, CVSS 7.6. EPSS: 0.6% chance of exploitation in the next 30 days. SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This…
CVE-2024-29120, published 2024-07-17. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to…