Every CVE Search/ Get API key

CVE-2020-9480

Improper Authentication in Apache Spark

9.8 CriticalPublic exploitFix available

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

29.4%Up 25.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
CVE-2020-9480
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-306
Updated
2026-11-02
CVE List No score

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
CVE-2020-9480
Updated
2026-11-02
EUVDEUVD-2020-0158 No score

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
EUVD-2020-0158
Updated
2026-11-03
GitHub AdvisoriesGHSA-wgx7-jwwm-cgjv 9.3

Improper Authentication in Apache Spark

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
GHSA-wgx7-jwwm-cgjv
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-306
Updated
2026-11-02
OSV 9.8

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
CVE-2020-9480
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-wgx7-jwwm-cgjv 9.3

Improper Authentication in Apache Spark

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
GHSA-wgx7-jwwm-cgjv
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-306
Updated
2026-11-02
OSVBIT-spark-2020-9480 No score

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
BIT-spark-2020-9480
Updated
2026-11-02
OSVPYSEC-2020-95 No score

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Record
PYSEC-2020-95
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.spark:spark-parent_2.11
Maven
 through 2.4.5
2.4.6
pyspark
PyPI
 before 2.4.6
2.4.6
spark
Bitnami
 before 2.4.6
2.4.6
org.apache.spark:spark-parent_2.11
Maven
 before 2.4.6, plus listed versions
1.3.01.3.11.4.01.4.11.5.0
Show 29 moreShow less
1.5.11.5.21.6.01.6.11.6.21.6.32.0.02.0.0-preview2.0.12.0.22.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.5
2.4.6
pyspark
PyPI
 before 2.4.6, plus listed versions
2.1.12.1.22.1.32.2.02.2.1
Show 13 moreShow less
2.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.5
2.4.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiApache Spark - Authentication Bypass
PoC in GitHubXiaoShaYu617/CVE-2020-94802024-07-25

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-9480 is a critical vulnerability (CVSS 9.8) in Apache Spark, published June 23, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 29.4%, the 98th percentile. Fixed in org.apache.spark:spark-parent_2.11 2.4.6.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open