By vendor

Apache vulnerabilities

Known CVEs affecting Apache products, prioritized by severity, with SEC.co remediation and detection guidance.

130 published vulnerabilities · page 2 of 2

• CVE-2026-52760MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Apache ActiveMQ's Web Console browse page. An authenticated message producer can craft a JMS message ID containing malicious HTML or JavaScript. When an administrator browses the queue through the Web Console, that payload executes in their browser, potentially allowing the attacker to steal session tokens, modify queue contents, or perform actions as the administrator. The vulnerability requires authentication to trigger but exploits a trust boundary between producer and administrator roles.

• CVE-2026-41017MEDIUM 5.9

  Apache Airflow's JWT authentication middleware fails to mark session cookies as secure, exposing them to interception when the API server sits behind a TLS-terminating reverse proxy—a standard cloud architecture. An attacker on a shared network (public Wi-Fi, compromised LAN, or captive portal) can intercept an authenticated user's session token and replay it to gain API access. The vulnerability only materializes in specific deployment topologies where the reverse proxy strips HTTPS before forwarding to Airflow; teams running Airflow with end-to-end encryption or without reverse proxies are not affected. Apache Airflow 3.2.2 and later patch this issue.

• CVE-2026-49267MEDIUM 5.9

  Apache Airflow's EmailOperator and email utilities fail to validate the SMTP server's certificate when configured to use STARTTLS encryption without full SSL/TLS. This allows an attacker on the network between your Airflow worker and SMTP server to intercept the connection, inject a fraudulent certificate, and steal login credentials and email contents without detection. The risk is elevated in environments where the SMTP relay sits outside your trusted network perimeter.

• CVE-2026-49270MEDIUM 5.9

  Apache ActiveMQ brokers with network connectors configured to sync durable subscriptions are leaking sensitive metadata to unauthenticated attackers. An attacker can request a complete list of durable topic subscriptions, including client IDs, subscription names, destination topics, and JMS selector expressions—all without needing to authenticate. This occurs because the broker responds to BrokerInfo commands before validating the connection's authentication status.

• CVE-2026-44046MEDIUM 5.8

  Apache APISIX contains a vulnerability in its wolf-rbac plugin that allows an attacker to inject false identity information into logs and bypass IP-based access controls. The plugin uses insufficiently trusted data sources to make security decisions, enabling an attacker to spoof their identity and potentially circumvent network-level access restrictions. This affects versions 1.2.0 through 3.16.0 and is resolved in version 3.17.0.

• CVE-2026-44119MEDIUM 5.5

  Apache HTTP Server versions 2.4.67 and earlier contain a privilege escalation vulnerability that allows local users who can author .htaccess files to read arbitrary files with the permissions of the httpd daemon user. This is a local-only vulnerability requiring existing system access and the ability to modify .htaccess configuration files, but it can expose sensitive application data and system files to unprivileged users.

• CVE-2025-53648MEDIUM 5.4

  A SQL misconfiguration in Apache Gravitino's web interface allows authenticated users to read or delete files on the server. This vulnerability exists in version 1.0.0 and earlier. While an attacker must have valid login credentials, the impact is significant—they can extract sensitive data or destroy critical files without elevated permissions.

• CVE-2025-62198MEDIUM 5.4

  Apache Atlas, a metadata governance platform, contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with valid credentials can craft requests that execute arbitrary JavaScript in the browsers of other users who interact with the application. This is a browser-based attack that relies on user interaction to succeed; the attacker cannot directly access or modify data on the server, but can steal session tokens, deface content, or redirect users to malicious sites.

• CVE-2026-34033MEDIUM 5.4

  Apache Answer contains a cross-site scripting (XSS) vulnerability in its notification email system. When authenticated users include content in certain fields, that content reaches other users' inboxes without proper HTML escaping, potentially allowing injection of malicious scripts. An attacker with valid credentials could craft messages designed to execute code when recipients open their emails or click embedded links. This affects Apache Answer versions through 2.0.0.

• CVE-2026-49231MEDIUM 5.4

  Apache APISIX versions 3.5.0 through 3.16.0 contain an authentication bypass flaw in the OPA (Open Policy Agent) plugin. An attacker with valid credentials can craft spoofed identity headers that the OPA plugin relays upstream without proper validation, allowing privilege escalation on connected services. The vulnerability only manifests in non-default configurations, meaning deployments using standard settings are not affected.

• CVE-2026-46453MEDIUM 5.3

  Apache Camel's Elasticsearch REST client component has a critical configuration oversight that allows unauthenticated attackers to hijack Elasticsearch operations when the component is exposed via HTTP. The vulnerability stems from improperly named HTTP headers that bypass Camel's standard security filtering. An attacker can inject headers to read all documents, delete data, or extract sensitive information without any credentials. This affects multiple versions of Apache Camel and requires immediate patching or defensive workarounds.

• CVE-2026-48206MEDIUM 5.3

  Apache Camel's JIRA integration allows unauthenticated attackers to manipulate JIRA operations by injecting HTTP headers. When a Camel route bridges incoming HTTP requests to a JIRA producer, attackers can inject headers that override the route's intended parameters—such as which issue to modify, which project to target, or what transition to apply—using the service account credentials configured in the endpoint. The vulnerability stems from Camel's header filtering logic, which was designed to block internal Camel-namespaced headers but inadvertently allowed plain header names (like 'IssueKey' and 'ProjectKey') to pass through from HTTP clients. This means an attacker can perform JIRA operations—deleting issues, changing their status, creating issues in unintended projects, modifying fields, managing watchers, or logging time—limited only by what the service account is permitted to do.

• CVE-2026-49098MEDIUM 5.3

  Apache Camel's Kafka component contains a header-injection vulnerability that allows untrusted HTTP clients to redirect Kafka messages to unintended topics. When an HTTP consumer (like platform-http) is chained into a Kafka producer within the same Camel route, attackers can inject kafka.* headers through HTTP requests to override the configured target topic, alter timestamps, or target specific partitions. This is possible because the HTTP header filter only blocks Camel-prefixed headers, allowing kafka.* headers to pass through and reach the Kafka producer unfiltered. No authentication is required if the HTTP endpoint is publicly accessible.

• CVE-2026-49099MEDIUM 5.3

  Apache Camel's Salesforce component has a vulnerability that allows attackers to hijack database queries and operations by injecting malicious headers through HTTP requests. When a route connects an HTTP endpoint to Salesforce, an unauthenticated attacker can override the intended SOQL queries, target objects, or API calls by setting specific HTTP headers. These operations execute with full permissions of the Salesforce integration user, potentially exposing sensitive data or performing unauthorized modifications. The issue stems from Camel's HTTP header filtering not recognizing Salesforce control headers as privileged, allowing them to pass through from untrusted external sources.

• CVE-2026-49328MEDIUM 5.3

  A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Fesod's image URL handling component. When an application built on Fesod processes user-supplied image URLs, an attacker can craft malicious URLs that cause the server to make unexpected outbound requests to internal systems, private cloud metadata services, or other network-restricted resources. This allows attackers to probe or interact with infrastructure that should not be directly accessible from the internet.

• CVE-2026-49365MEDIUM 5.3

  Apache Camel's Netty HTTP component has a flaw where error messages are returned to users in plain text, potentially exposing sensitive information like stack traces, credentials, and internal system details. The problem stems from a default setting (muteException=false) that differs from other Camel HTTP components. Any unauthenticated user who can reach the endpoint and trigger an error—such as sending a malformed request—receives the full Java stack trace, which can reveal internal architecture and aid attackers in planning further compromises.

• CVE-2026-50629MEDIUM 5.3

  An OAuth2 server vulnerability allows attackers to inject malicious log entries by sending specially crafted requests with unvalidated control characters in the client ID parameter. The vulnerability does not leak sensitive data or directly crash the system, but it enables log manipulation—a tactic often used to cover attack tracks or create false evidence. Apache CXF versions prior to 4.2.2 and 4.1.7 are affected.

• CVE-2026-54665MEDIUM 5.3

  Apache NiFi versions up to 2.9.0 fail to validate certain HTTP headers that web proxies use to communicate the client's original hostname. An attacker can send specially crafted headers to trick NiFi into generating incorrect URLs for redirects or embedding in responses, potentially directing users to malicious sites or exposing data references. This is a header-injection vulnerability that affects the application's URL-building logic. The fix is available in NiFi 2.10.0, which adds validation for these proxy headers.

• CVE-2026-56139MEDIUM 5.3

  Apache Camel's Undertow HTTP component has a configuration flaw that causes it to leak sensitive information through error messages. When a client sends a request that triggers an exception, the server returns the full Java stack trace to the requester instead of a generic error response. This happens because the component defaults to exposing exceptions (muteException=false), contrary to other Camel HTTP components. An attacker who can reach an affected endpoint and cause any processing error—such as sending malformed data or invalid parameters—receives detailed internal information including credentials, hostnames, file paths, database names, and application architecture details. The flaw is particularly dangerous in Rest DSL deployments, where the mitigation option is completely ignored even if configured.

• CVE-2026-41280MEDIUM 4.9

  Apache DolphinScheduler contains an authorization flaw that allows authenticated users with system login privileges to delete task definitions in projects they shouldn't have access to. The vulnerability arises from insufficient permission checks when handling task definition deletion requests. An attacker with valid system credentials could exploit this to disrupt workflow orchestration by removing critical task definitions from other projects, potentially causing operational disruption. The issue is limited to versions before 3.4.2 and requires existing system access to exploit.

• CVE-2026-50623MEDIUM 4.8

  Apache CXF contains an authentication bypass flaw in its OAuth2 token introspection endpoint. A missing security check allows unauthenticated attackers to access the /services/oauth2/introspect endpoint if authentication has not been explicitly enabled on that service. While the vulnerability requires a pre-existing misconfiguration, it could expose token metadata or enable further attacks against OAuth2 flows. Patched versions 4.2.2 and 4.1.7 address the underlying code defect.

• CVE-2026-40914MEDIUM 4.3

  Apache Artemis has a flaw in how it enforces permissions when users communicate via the STOMP protocol. A user with permission to send or receive messages on a particular address can trick the system into accepting messages with a message routing-type that the address doesn't normally support. This bypasses an important security boundary: only administrators with explicit createAddress permission should be able to change an address's routing-type capabilities. An attacker could exploit this to send or consume messages in ways that violate the intended security policy, even though their basic send/consume permissions are legitimate.

• CVE-2026-41014MEDIUM 4.3

  Apache Airflow contains an authorization bypass in its UI that allows authenticated users to view information about data pipeline runs (DAGs) they shouldn't have access to. Specifically, a user with broad asset-level read permissions can see partition run states, scheduling details, and data connections for DAGs restricted to other teams or users. This affects only deployments that intentionally segment DAG access by user or role while granting wider asset visibility. The vulnerability requires an existing user account and network access to the Airflow UI or API.

• CVE-2026-41115MEDIUM 4.3

  Apache Kafka contains an authorization mismatch in its consumer group metadata API. The CONSUMER_GROUP_DESCRIBE operation checks for DESCRIBE permission on groups, but Kafka's documentation and the relevant design specification (KIP-848) incorrectly state it should check for READ permission. This inconsistency between code behavior and documentation can lead to misconfigured access controls—either granting unintended READ access to users who only have DESCRIBE permissions, or blocking legitimate access for users who rely on documentation-based ACL configurations. The vulnerability is not a code flaw but a documentation gap that can cause real-world security postures to diverge from intent.

• CVE-2026-46605MEDIUM 4.3

  Apache ActiveMQ has an authorization flaw that allows authenticated users to delete message queues and topics they shouldn't be able to modify. An attacker with valid credentials to your messaging system could disrupt operations by removing critical destinations, even if permission controls suggest they shouldn't have that ability. This affects ActiveMQ versions before 5.19.7 and 6.0.0 through 6.2.5.

• CVE-2026-46764MEDIUM 4.3

  Apache Airflow contains an authorization bypass flaw in its audit-log API endpoints. An authenticated user with read access to audit logs for one workflow (Dag) can bypass per-Dag scoping restrictions and view audit-log entries from any other Dag in the same Airflow deployment by directly requesting specific event log IDs. The vulnerability stems from inconsistent permission enforcement: the collection endpoint properly restricts results by Dag, but the detail endpoint applies only a generic audit-log permission check without verifying the requester has access to the specific Dag whose logs are being retrieved. This allows low-privileged users to enumerate and read sensitive audit trails across Dags they should not be able to access.

• CVE-2026-48891MEDIUM 4.3

  Apache Airflow contains an information disclosure vulnerability in its web UI's dependency graph viewer. Authenticated users with permission to read certain workflows can inadvertently discover the names and identifiers of other workflows they should not have access to by examining trigger and sensor dependency relationships displayed in the graph. This happens because the filtering logic that restricts which workflows a user can see was incompletely applied—it hides the top-level workflow information but still leaks workflow identifiers in the detailed dependency connections. Organizations relying on workflow-level access controls to keep workflow names confidential across teams are at risk.

• CVE-2026-46584LOW 3.7

  Apache Camel's mail component has an input validation flaw that allows untrusted data to override email sending configuration. If a Camel route accepts input from external sources (like HTTP requests or message queues) and passes it directly to an SMTP/SMTPS producer without filtering, an attacker can inject malicious mail configuration headers. On older versions (before 4.19.0), this could redirect email traffic to attacker-controlled servers, exposing configured SMTP credentials. On newer versions, the attack is limited to weakening security settings or intercepting message content. The vulnerability only materializes in routes that lack proper input sanitization.

• CVE-2026-40963LOW 3.1

  Apache Airflow's UI structure_data endpoint was leaking metadata about linked workflows (DAGs) to users who shouldn't see them. An authenticated user with permission to view one workflow could discover the names and dependency relationships of other workflows they weren't authorized to access. This is a read-only information disclosure—no data modification or system disruption occurs—but it can undermine team isolation in multi-tenant Airflow deployments where workflow topology is considered sensitive.

• CVE-2026-45426LOW 3.1

  Apache Airflow's log server uses a flawed string-matching approach to authorize workers' access to task logs. Instead of checking if a worker's JWT token matches a specific Dag name exactly, the system strips characters from the left side of requested Dag names in a way that can match multiple unintended Dags. An authenticated worker with a token for 'dag_a' could read logs from 'dag_attacker', 'aaaa_target', or '_dag_secret'—any Dag whose name starts with characters found in 'dag_a'. This breaks the intended per-Dag log isolation in multi-team environments.