CVE-2018-17190
Remote Code Execution in spark-core
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
- Record
CVE-2018-17190- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
- Record
CVE-2018-17190- Updated
- 2026-11-02
EUVDEUVD-2018-0765 No score
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
- Record
EUVD-2018-0765- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-phg2-9c5g-m4q7
Remote Code Execution in spark-core
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
Mitigation
Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions. Use spark.authenticate and related security properties described at https://spark.apache.org/docs/latest/security.html
- Record
GHSA-phg2-9c5g-m4q7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-phg2-9c5g-m4q7
Remote Code Execution in spark-core
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
Mitigation
Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions. Use spark.authenticate and related security properties described at https://spark.apache.org/docs/latest/security.html
- Record
GHSA-phg2-9c5g-m4q7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.spark:spark-core_2.11Maven |
All versions | None known |
org.apache.spark:spark-core_2.10Maven |
All versions | None known |
org.apache.spark:spark-core_2.11Maven |
All versions, plus listed versions 1.2.01.2.11.2.21.3.01.3.1 Show 35 moreShow less1.4.01.4.11.5.01.5.11.5.21.6.01.6.11.6.21.6.32.0.02.0.0-preview2.0.12.0.22.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.8 |
None known |
org.apache.spark:spark-core_2.10Maven |
All versions, plus listed versions 0.9.0-incubating0.9.10.9.21.0.01.0.1 Show 29 moreShow less1.0.21.1.01.1.11.2.01.2.11.2.21.3.01.3.11.4.01.4.11.5.01.5.11.5.21.6.01.6.11.6.21.6.32.0.02.0.0-preview2.0.12.0.22.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-17190 is a critical vulnerability (CVSS 9.8) in Apache Spark, published November 19, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.79%, the 95th percentile. No source names a fixed version.
References
securityfocus.com/bid/105976
security.gentoo.org/glsa/201903-21
oracle.com/security-alerts/cpujul2020.html
lists.apache.org/thread.html/341c3187f15cdb0d353261d2bfecf2324d56cb7db1339bfc7b30f6e5%40%3Cdev.spark.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2018-17190
github.com/advisories/GHSA-phg2-9c5g-m4q7