Every CVE Search/ Get API key

CVE-2023-22946

Apache Spark proxy-user privilege escalation from malicious configuration class

6.4 MediumFix available

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.11%Up 1.1 points since Apr 17, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.4

Apache Spark proxy-user privilege escalation from malicious configuration class

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
CVE-2023-22946
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-269
Updated
2026-11-02
EUVDEUVD-2023-0219 6.4

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
EUVD-2023-0219
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-329j-jfvr-rhr6 9.9

Apache Spark vulnerable to Improper Privilege Management

In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a proxy-user to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
GHSA-329j-jfvr-rhr6
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
NVD 6.4

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
CVE-2023-22946
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
OSV 6.4

Apache Spark proxy-user privilege escalation from malicious configuration class

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
CVE-2023-22946
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-269
Updated
2026-11-02
OSVGHSA-329j-jfvr-rhr6 9.9

Apache Spark vulnerable to Improper Privilege Management

In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a proxy-user to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
GHSA-329j-jfvr-rhr6
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
OSVBIT-spark-2023-22946 No score

Apache Spark proxy-user privilege escalation from malicious configuration class

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
BIT-spark-2023-22946
Updated
2026-11-02
OSVPYSEC-2023-44 No score

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Record
PYSEC-2023-44
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2023-22946 No score

CVE-2023-22946 in pyspark - Patched by Root

Root has patched CVE-2023-22946 in the pyspark package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2023-22946
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.spark:spark-core_2.12
Maven
 through 3.3.2
3.3.3
org.apache.spark:spark-core_2.13
Maven
 through 3.3.2
3.3.3
pyspark
PyPI
 before 3.3.2
3.3.2
spark
Bitnami
 before 3.4.0
3.4.0
org.apache.spark:spark-core_2.12
Maven
 before 3.3.3, plus listed versions
2.4.02.4.12.4.22.4.32.4.4
Show 22 moreShow less
2.4.52.4.62.4.72.4.83.0.03.0.0-preview3.0.0-preview23.0.13.0.23.0.33.1.03.1.13.1.23.1.33.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.2
3.3.3
org.apache.spark:spark-core_2.13
Maven
 before 3.3.3, plus listed versions
3.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.2
3.3.3
pyspark
PyPI
 before 3.3.2, plus listed versions
2.1.12.1.22.1.32.2.02.2.1
Show 30 moreShow less
2.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.83.0.03.0.13.0.23.0.33.1.13.1.23.1.33.2.03.2.13.2.23.2.33.2.43.3.03.3.1
3.3.2
pyspark
PyPI
 before 3.4.0, plus listed versions
2.1.12.1.22.1.32.2.02.2.1
Show 33 moreShow less
2.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.83.0.03.0.13.0.23.0.33.1.13.1.23.1.33.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.3.4
3.4.0

History

History
RecordedChangedSources
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22946 is a medium vulnerability (CVSS 6.4) in Apache Spark, published April 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in org.apache.spark:spark-core_2.12 3.3.3.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open