CVE-2018-1334 Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark

What is CVE-2018-1334?

CVE-2018-1334 is a medium-severity authentication bypass vulnerability in Apache Spark, published on 12 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

Weakness: CWE-200

Which versions are affected by CVE-2018-1334?

15 open source packages ship an affected version, including org.apache.spark:spark-core_2.11, org.apache.spark:spark-core_2.10 and pyspark. It affects 1 product.

Products include Apache Spark.

How do I fix CVE-2018-1334?

Upgrade org.apache.spark:spark-core_2.11 to a fixed version for your release line: 2.1.3, 2.2.2 or 2.3.1.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-1334 being exploited?

There is no known exploitation of CVE-2018-1334 in the wild and no public exploit code.

Other vulnerabilities in Apache Spark

• CVE-2022-33891 Apache Spark Command Injection Exploited High 8.8
• CVE-2020-9480 Improper Authentication in Apache Spark Critical 9.8
• CVE-2018-17190 Remote Code Execution in spark-core Critical 9.8
• CVE-2019-20445 HTTP Request Smuggling in Netty Critical 9.1
• CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6mqq-8r44-vmjc, PYSEC-2018-25.