Vulnerabilidades de Apache Software Foundation

CVE-2026-57914 Média · 6.5 CWE-400 26/06/2026

Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

CVE-2026-49486 Alta · 7.5 CWE-319 26/06/2026

Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.

CVE-2026-56130 Baixa · 2.0 CWE-294 25/06/2026

Apache Shiro: Remember-me cookie isn't checked for expiry on the server

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.

CVE-2026-56091 Alta · 8.2 CWE-289 25/06/2026

Apache Shiro: Authentication bypass in Guice-Web integration

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.

CVE-2026-54226 Média · 6.4 CWE-190 25/06/2026

Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS

A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2026-46752 Crítica · 10.0 CWE-122 25/06/2026

Apache Kvrocks: estouro de heap na biblioteca cjson do Lua

Estouro de heap (HEAP overflow) no Lua do Redis, na biblioteca cjson, vulnerabilidade no Apache Kvrocks. Esta questão afeta Apache Kvrocks: de 2.0.4 até 2.15.0. Recomenda-se que os usuários façam upgrade para a versão 2.16.0, que corrige o problema.

CVE-2026-46751 Média · 5.5 25/06/2026

Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.

A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2026-45188 Baixa · 2.4 CWE-23 25/06/2026

Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling

Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2026-41566 Crítica · 9.4 CWE-280 25/06/2026

Apache Kvrocks: vulnerabilidade de tratamento inadequado de permissões insuficientes (CVE-2026-41566)

Vulnerabilidade de Tratamento Inadequado de Permissões Insuficientes ou Privilégios em Apache Kvrocks. Esse problema afeta o Apache Kvrocks: 2.8.0. Recomenda-se que os usuários atualizem para a versão 2.16.0, que corrige o problema.

CVE-2026-54665 Média · 5.3 CWE-346 22/06/2026

Apache NiFi: Missing Validation for Proxy Host Headers

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in the HTTP Host header, but did not apply the validation to alternative Proxy and Forwarded headers. The absence of proxy host header validation allowed a client to instruct Apache NiFi web services to construct invalid qualified URLs for redirection or data references. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which implements validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers based on the nifi.web.proxy.host property. Enabling header validation requires configuring the application with HTTPS. Reverse proxy servers in front of Apache NiFi are responsible for filtering input request headers and providing allowed values to the application.

CVE-2026-44914 Alta · 7.2 CWE-862 22/06/2026

Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.

CVE-2026-44913 Alta · 7.2 CWE-116 22/06/2026

Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

CVE-2026-44911 Média · 6.3 CWE-863 22/06/2026

Apache NiFi: Incorrect Authorization for Configuration Verification Requests

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.

CVE-2025-66336 Alta · 8.1 CWE-89 22/06/2026

Apache Doris MCP Server: SQL injection leading the authentication bypass

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

CVE-2025-62198 Média · 5.4 CWE-80 22/06/2026

Apache Atlas: Stored XSS in Create Entity page

An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes the issue.

CVE-2026-49872 Alta · 8.1 CWE-287 19/06/2026

Apache APISIX: Improper authentication in cas-auth plugin

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49871 Crítica · 9.3 CWE-352 19/06/2026

Vulnerabilidade de CSRF no plugin cas-auth do Apache APISIX (CVE-2026-49871)

Vulnerabilidade de Cross-Site Request Forgery (CSRF) no plugin cas-auth em configurações padrão. Esse defeito permite que um atacante remoto que consiga levar uma vítima a uma página web controlada por ele faça o navegador da vítima ficar autenticado como outra identidade. Ações que a vítima realiza no upstream são então atribuídas à identidade do atacante. Esse problema afeta o Apache APISIX: da versão 3.0.0 até a 3.16.0. Recomenda-se que os usuários atualizem para a versão 3.17.0, que corrige o problema.

CVE-2026-49231 Média · 5.4 CWE-290 19/06/2026

Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49230 Crítica · 9.1 CWE-354 19/06/2026

Bypass de autenticação no plugin jwe-decrypt do Apache APISIX por validação inadequada de integridade

Validação inadequada de valor de verificação de integridade (Improper Validation of Integrity Check Value) em Apache APISIX. O plugin jwe-decrypt, na configuração padrão, é vulnerável a bypass de autenticação. Este problema afeta o Apache APISIX: da versão 3.8.0 até 3.16.0. Recomenda-se que os usuários atualizem para a versão 3.17.0, que corrige o problema.

CVE-2026-48895 Alta · 7.2 CWE-601 19/06/2026

Apache APISIX: Cas-auth Host header influence on CAS service URL

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-47341 Média · 6.5 CWE-294 19/06/2026

Apache APISIX: Session replay issue in hmac-auth

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-47339 Alta · 8.1 CWE-863 19/06/2026

Apache APISIX: authz-casdoor incorrect session sharing

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-44915 Média · 6.1 CWE-601 19/06/2026

Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-44087 Crítica · 9.1 CWE-345 19/06/2026

Apache APISIX: falha de spoofing de cabeçalhos de identidade no plugin openid-connect (CVE-2026-44087)

Vulnerabilidade de Verificação Insuficiente da Autenticidade de Dados no Apache APISIX. O plugin openid-connect, com configuração padrão, possui uma superfície de ataque que permite ao atacante falsificar cabeçalhos de identidade, possibilitando acesso não autorizado a recursos protegidos. Este problema afeta o Apache APISIX: da versão 2.3 até a 3.16.0. Recomenda-se que os usuários atualizem para a versão 3.17.0, que corrige o problema.

CVE-2026-44046 Média · 5.8 CWE-348 19/06/2026

Apache APISIX: wolf-rbac plugin Identity Spoofing

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.