CVE-2025-68637 Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-68637?
CVE-2025-68637 is a critical vulnerability in Apache Uniffle, published on 7 Jan 2026.
Official description
The Uniffle HTTP client is configured to trust all SSL certificates and
disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.
This issue affects all versions from before 0.10.0.
Users are recommended to upgrade to version 0.10.0, which fixes the issue.
Weakness: CWE-297
Which versions are affected by CVE-2025-68637?
It affects 1 product.
Products include Apache Uniffle.
How do I fix CVE-2025-68637?
No fix has been published for CVE-2025-68637 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-68637 being exploited?
There is no known exploitation of CVE-2025-68637 in the wild and no public exploit code.
Sources
Also known as GHSA-36gx-mxh9-mx5r.