Apache Streampipes vulnerabilities

7 CVEs affecting Apache Streampipes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47411, published 2026-01-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-47411, published 2026-01-01. High severity, CVSS 8.1. EPSS: 15.3% chance of exploitation in the next 30 days. A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with…
CVE-2024-29868, published 2024-06-24. Critical severity, CVSS 9.1. EPSS: 6% chance of exploitation in the next 30 days. Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the…
CVE-2024-31411, published 2024-07-17. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted…
CVE-2023-31469, published 2023-06-23. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges…
CVE-2024-31979, published 2024-07-17. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which…
CVE-2024-24778, published 2025-03-03. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through…
CVE-2024-30471, published 2024-07-17. Low severity, CVSS 3.7. EPSS: 0.7% chance of exploitation in the next 30 days. Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with…