Vulnerabilidades de Apache Software Foundation

CVE-2026-68872 Média · 6.5 CWE-639 10/08/2026

Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

CVE-2026-68871 Média · 6.5 CWE-639 10/08/2026

Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

CVE-2026-68870 Média · 5.3 CWE-639 10/08/2026

Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

CVE-2026-65948 Alta · 7.3 CWE-307 10/08/2026

Apache Ranger: UnixAuth lacks brute-force protection

UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-65945 Média · 6.5 CWE-532 10/08/2026

Apache Ranger: Logs contain replayable JWT bearer tokens

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-65942 Alta · 7.5 CWE-297 10/08/2026

Apache Ranger: Clients accept TLS certificates issued for other hostnames

TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-61899 Alta · 7.5 CWE-200 10/08/2026

Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

CVE-2026-55814 Alta · 7.5 CWE-306 10/08/2026

Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-55799 Crítica · 9.8 CWE-94 10/08/2026

Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-44416 Crítica · 9.8 CWE-94 10/08/2026

Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-42537 Crítica · 9.8 CWE-20 10/08/2026

Apache Ranger: Remote Code Execution via JDBC URL Injection

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-40920 Crítica · 9.8 CWE-20 10/08/2026

Apache Ranger: Privilege Escalation via URL Parameter

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-32227 Crítica · 9.8 CWE-89 10/08/2026

Apache Ranger: SQL Injection vulnerability in lookup functionality

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.

CVE-2026-28672 Crítica · 9.8 CWE-77 10/08/2026

Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

CVE-2026-44630 Alta · 7.5 CWE-400 10/08/2026

Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

CVE-2026-71560 Crítica · 9.1 CWE-125 07/08/2026

Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

CVE-2026-71559 Alta · 7.5 CWE-502 07/08/2026

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

CVE-2026-71558 Crítica · 9.8 CWE-843 07/08/2026

Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

CVE-2026-34502 Alta · 7.5 CWE-122 06/08/2026

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

CVE-2026-34501 Alta · 7.5 CWE-122 06/08/2026

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

CVE-2026-34191 Crítica · 9.1 CWE-89 06/08/2026

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

CVE-2026-32327 Crítica · 9.1 CWE-674 06/08/2026

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVE-2025-49506 Alta · 7.5 CWE-208 06/08/2026

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVE-2026-68481 Alta · 7.5 CWE-672 06/08/2026

Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

CVE-2026-68079 Crítica · 9.8 CWE-294 06/08/2026

Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.