CVE-2025-32896

Apache SeaTunnel: Unauthenticated insecure access

6.5 MediumFix available

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.16%Up 1.1 points since Jun 19, 2025

What each source reports

CVE List Score used 6.5

Apache SeaTunnel: Unauthenticated insecure access

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Record: CVE-2025-32896
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-306
Updated: 2026-11-02

EUVDEUVD-2025-18684 6.5

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Record: EUVD-2025-18684
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9x53-gr7p-4qf5 2.7

Apache SeaTunnel: Unauthenticated insecure access

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Record: GHSA-9x53-gr7p-4qf5
CVSS 4.0: 2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness: CWE-306
Updated: 2026-11-02

NVD 6.5

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Record: CVE-2025-32896
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-306
Updated: 2026-11-02

OSV 6.5

Apache SeaTunnel: Unauthenticated insecure access

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Record: CVE-2025-32896
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-306
Updated: 2026-11-02

OSVGHSA-9x53-gr7p-4qf5 2.7

Apache SeaTunnel: Unauthenticated insecure access

Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

Details

Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Record: GHSA-9x53-gr7p-4qf5
CVSS 4.0: 2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness: CWE-306
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.seatunnel:seatunnel-engine-server` Maven	before 2.3.11	2.3.11
`org.apache.seatunnel:seatunnel-engine-common` Maven	before 2.3.11	2.3.11
`org.apache.seatunnel:seatunnel-engine-server` Maven	before 2.3.11, plus listed versions 2.3.02.3.0-beta2.3.12.3.102.3.2 Show 7 moreShow less 2.3.32.3.42.3.52.3.62.3.72.3.82.3.9	2.3.11
`org.apache.seatunnel:seatunnel-engine-common` Maven	before 2.3.11, plus listed versions 2.3.02.3.0-beta2.3.12.3.102.3.2 Show 7 moreShow less 2.3.32.3.42.3.52.3.62.3.72.3.82.3.9	2.3.11

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-32896 is a medium vulnerability (CVSS 6.5) in Apache Seatunnel, published June 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in org.apache.seatunnel:seatunnel-engine-server 2.3.11.

Summary

Details

Fixed

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Summary

Details

Fixed

Summary

Details

Fixed

Summary

Details

Fixed

Summary

Details

Fixed

Summary

Details

Fixed

Summary

Details

Fixed

Affected products

Affected packages

History

In short

References