CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation

What is CVE-2025-47411?

CVE-2025-47411 is a high-severity vulnerability in Apache StreamPipes, published on 1 Jan 2026.

Official description

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. 

This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues.

This issue affects Apache StreamPipes: through 0.97.0.

Users are recommended to upgrade to version 0.98.0, which fixes the issue.

Weakness: CWE-269

Which versions are affected by CVE-2025-47411?

2 open source packages ship an affected version, including org.apache.streampipes:streampipes-parent. It affects 1 product.

Products include Apache Streampipes.

How do I fix CVE-2025-47411?

Upgrade org.apache.streampipes:streampipes-parent to 0.98.0 or later.

Is CVE-2025-47411 being exploited?

There is no known exploitation of CVE-2025-47411 in the wild and no public exploit code.

Other vulnerabilities in Apache StreamPipes

• CVE-2024-29868 Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation Critical 9.1
• CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user High 8.8
• CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process High 7.5
• CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation Medium 6.5
• CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload Medium 6.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5r2g-vphf-m5xc.