CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

What is CVE-2025-32896?

CVE-2025-32896 is a medium-severity missing authorization vulnerability in Apache SeaTunnel, published on 19 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

# Summary

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1.

# Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack.

This issue affects Apache SeaTunnel: <=2.3.10

# Fixed

Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

Weakness: CWE-306

Which versions are affected by CVE-2025-32896?

4 open source packages ship an affected version, including org.apache.seatunnel:seatunnel-engine-common and org.apache.seatunnel:seatunnel-engine-server. It affects 1 product.

Products include Apache Seatunnel.

How do I fix CVE-2025-32896?

Upgrade org.apache.seatunnel:seatunnel-engine-common to 2.3.11 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-32896 being exploited?

There is no known exploitation of CVE-2025-32896 in the wild and no public exploit code.

Other vulnerabilities in Apache SeaTunnel

• CVE-2023-48396 Apache SeaTunnel Web: Authentication bypass Critical 9.1
• CVE-2023-49198 Apache SeaTunnel Web: Arbitrary file read vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9x53-gr7p-4qf5.