CVE-2025-54947 Apache StreamPark: Use hard-coded key vulnerability
Attackers can decrypt sensitive data or forge information using a hard-coded key, leading to information disclosure and unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54947?
CVE-2025-54947 is a medium-severity vulnerability in Apache StreamPark, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Which versions are affected by CVE-2025-54947?
2 open source packages ship an affected version, including org.apache.streampark:streampark. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.streampark:streampark Maven | From 2.0.0 | 2.1.7 |
org.apache.streampark:streampark Maven | From 2.0.0 | 2.1.7 |
Products include Apache Streampark.
How do I fix CVE-2025-54947?
Upgrade org.apache.streampark:streampark to 2.1.7 or later.
Is CVE-2025-54947 being exploited?
There is no known exploitation of CVE-2025-54947 in the wild and no public exploit code.
Other vulnerabilities in Apache StreamPark
- CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory
- CVE-2024-29070 Apache StreamPark: session not invalidated after logout
- CVE-2022-46365 Apache StreamPark (incubating): Logic error causing any account reset
- CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
Sources
Also known as GHSA-prv5-c2px-j9q3.