Apache security advisories, August 2026

Apache advisories published in August 2026

1. Aug 31, 2026
   High [CVE-2026-71257] Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload

   High7.5

2. Aug 31, 2026
   Medium [CVE-2026-76986] Improper neutralization of input during web page generation in Apache Wicket

   Medium6.1

3. Aug 31, 2026
   Medium [CVE-2026-76985] Improper neutralization of input during web page generation in Apache Wicket

   Medium5.1

4. Aug 31, 2026
   Medium [CVE-2026-76983] Improper neutralization of input during web page generation in Apache Wicket

   Medium5.1

5. Aug 31, 2026
   Medium [CVE-2026-76984] Improper neutralization of input during web page generation in Apache Wicket

   Medium5.1

6. Aug 31, 2026
   Medium [CVE-2026-76982] Improper neutralization of input during web page generation in Apache Wicket

   Medium5.1

7. Aug 31, 2026
   Medium [CVE-2026-75802] Apache Wicket: AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values

   Medium5.1

8. Aug 31, 2026
   Medium [CVE-2026-71378] Apache Wicket: ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin

   Medium4.6

9. Aug 31, 2026
   Medium [CVE-2026-70449] Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve

   Medium5.3

10. Aug 31, 2026
    Medium [CVE-2026-58301] When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data

    Medium5.9

11. Aug 27, 2026
    High [CVE-2026-74848] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX

    High7.0

12. Aug 27, 2026
    High [CVE-2026-75005] Inefficient Algorithmic Complexity vulnerability in Apache APISIX

    High8.7

13. Aug 27, 2026
    High [CVE-2026-75020] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX

    High7.0

14. Aug 26, 2026
    Medium [CVE-2026-63041] Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX

    Medium5.3

15. Aug 25, 2026
    Critical [CVE-2026-68525] Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET

    Critical9.1

16. Aug 25, 2026
    Critical [CVE-2026-65905] Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator

    Critical9.8

17. Aug 25, 2026
    Critical [CVE-2026-32990 +1] Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990

    Critical9.8

18. Aug 25, 2026
    Critical [CVE-2026-65182] Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path

    Critical9.1

19. Aug 25, 2026
    Critical [CVE-2026-49845] SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default)

    Critical9.8

20. Aug 25, 2026
    Critical [CVE-2026-55976] Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is subsequently queried

    Critical9.1

21. Aug 25, 2026
    High [CVE-2026-68763] Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120

    High7.5

22. Aug 25, 2026
    High [CVE-2026-68569] Apache Tomcat: Principal lookup can fail open in some cases

    High8.1

23. Aug 25, 2026
    High [CVE-2026-66422] Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole

    High8.1

24. Aug 25, 2026
    High [CVE-2026-65927] Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule

    High7.5

25. Aug 25, 2026
    High [CVE-2026-65183] Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket

    High8.1

26. Aug 25, 2026
    High [CVE-2026-53561] improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint

    High7.4

27. Aug 25, 2026
    High [CVE-2026-49050] General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2

    High8.8

28. Aug 25, 2026
    Medium [CVE-2026-73180] Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended

    Medium6.8

29. Aug 24, 2026
    Critical [CVE-2025-30177 +1] Improper input validation vulnerability in Apache Camel Undertow component

    Critical9.8

30. Aug 24, 2026
    Critical [CVE-2026-55993 +1] Improper input validation vulnerability in Apache Camel Atmosphere Websocket component

    Critical9.8

31. Aug 24, 2026
    Critical [CVE-2026-66906] Relative path traversal vulnerability in Apache Camel Azure Storage Blob component

    Critical9.1

32. Aug 24, 2026
    High [CVE-2026-66908] Improper Authentication vulnerability in Apache Camel Platform HTTP Main component

    High7.5

33. Aug 24, 2026
    High [CVE-2026-66907] Relative path traversal vulnerability in Apache Camel Google Storage component

    High7.5

34. Aug 24, 2026
    Medium [CVE-2026-75099] Unauthenticated REST disclosure of certain content items in Apache Allura

    Medium5.3

35. Aug 24, 2026
    Medium [CVE-2025-27636 +5] Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers

    Medium5.3

36. Aug 24, 2026
    Medium [CVE-2026-60093] Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0

    Medium5.5

37. Aug 24, 2026
    Medium [CVE-2026-59230] Improper input validation vulnerability in Apache Camel

    Medium6.5

38. Aug 21, 2026
    Critical [CVE-2026-59085] Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests

    Critical9.1

39. Aug 21, 2026
    Critical [CVE-2026-61398] Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality

    Critical9.1

40. Aug 21, 2026
    Critical [CVE-2026-62440] Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes

    Critical9.1

41. Aug 21, 2026
    High [CVE-2026-63046] Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong

    High8.8

42. Aug 21, 2026
    High [CVE-2026-47359] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin

    High8.8

43. Aug 21, 2026
    High [CVE-2026-50112] Apache CloudStack: SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets

    High8.8

44. Aug 21, 2026
    High [CVE-2026-50222] Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs

    High7.5

45. Aug 21, 2026
    High [CVE-2026-59655] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers

    High7.5

46. Aug 21, 2026
    High [CVE-2026-59657] Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database

    High7.5

47. Aug 21, 2026
    High [CVE-2026-59780] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers

    High7.5

48. Aug 21, 2026
    High [CVE-2026-59799] Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow

    High8.8

49. Aug 21, 2026
    High [CVE-2026-61397] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration

    High7.5

50. Aug 21, 2026
    High [CVE-2026-61400] Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers

    High8.8

51. Aug 21, 2026
    High [CVE-2026-66722] Apache CloudStack: Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack

    High7.2

52. Aug 21, 2026
    High [CVE-2026-68745] Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server

    High8.1

53. Aug 21, 2026
    Medium [CVE-2026-59654] Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality

    Medium6.8

54. Aug 21, 2026
    Medium [CVE-2026-61399] Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality

    Medium4.8

55. Aug 21, 2026
    Medium [CVE-2026-61422] Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality

    Medium4.3

56. Aug 21, 2026
    Medium [CVE-2026-65613] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries

    Medium4.3

57. Aug 21, 2026
    Medium [CVE-2026-66797] Apache CloudStack: Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure

    Medium5.4

58. Aug 21, 2026
    Low [CVE-2026-66721] Apache CloudStack: Missing authorization issue for domain admins in CloudStack's host tags listing functionality

    Low2.7

59. Aug 20, 2026
    Critical [CVE-2026-63039] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong

    Critical9.8

60. Aug 20, 2026
    Critical [CVE-2026-63038] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong

    Critical9.8

61. Aug 20, 2026
    Critical [CVE-2026-63037] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong

    Critical9.8

62. Aug 20, 2026
    High [CVE-2026-63043] Relative Path Traversal vulnerability in Apache InLong

    High7.5

63. Aug 20, 2026
    High [CVE-2026-63042] Files or Directories Accessible to External Parties vulnerability in Apache InLong

    High8.1

64. Aug 20, 2026
    High [CVE-2026-63040] Files or Directories Accessible to External Parties vulnerability in Apache InLong

    High8.1

65. Aug 20, 2026
    Medium [CVE-2026-63044] Server-Side Request Forgery (SSRF) vulnerability in Apache InLong

    Medium5.4

66. Aug 20, 2026
    Medium [CVE-2026-63016] Uncontrolled Resource Consumption vulnerability in Apache InLong

    Medium5.3

67. Aug 20, 2026
    Medium [CVE-2026-63015] Uncontrolled Resource Consumption vulnerability in Apache InLong

    Medium4.3

68. Aug 18, 2026
    Critical [CVE-2026-34884] SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP

    Critical9.8

69. Aug 15, 2026
    High [CVE-2026-73635] Allocation of resources without limits or throttling vulnerability in Apache Struts

    High7.5

70. Aug 15, 2026
    High [CVE-2026-73634] Uncontrolled resource consumption vulnerability in Apache Struts

    High7.5

71. Aug 15, 2026
    Medium [CVE-2026-73632] Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts

    Medium4.3

72. Aug 15, 2026
    Medium [CVE-2026-73631] Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts

    Medium4.3

73. Aug 14, 2026
    High [CVE-2026-73633] Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts

    High7.5

74. Aug 13, 2026
    High [CVE-2026-66256] ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig

    High7.2

75. Aug 12, 2026
    Critical [CVE-2026-73240] Specifically crafted inputs may lead to git argument injection in Apache Allura

    Critical9.8

76. Aug 12, 2026
    High [CVE-2026-58076] Apache Airflow: Unguarded import_string of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

    High8.8

77. Aug 12, 2026
    High [CVE-2026-67260] Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

    High7.3

78. Aug 12, 2026
    High [CVE-2026-67587] Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

    High8.8

79. Aug 12, 2026
    High [CVE-2026-68968] Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

    High7.5

80. Aug 12, 2026
    Medium [CVE-2026-73237] XSS vulnerability in Markdown handling in Apache Allura

    Medium6.1

81. Aug 12, 2026
    Medium [CVE-2026-73238] XSS vulnerability in code display in Apache Allura

    Medium6.1

82. Aug 12, 2026
    Medium [CVE-2026-73239] Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura

    Medium6.5

83. Aug 12, 2026
    Medium [CVE-2026-59244] Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

    Medium6.5

84. Aug 12, 2026
    Medium [CVE-2026-59242] Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

    Medium5.4

85. Aug 12, 2026
    Medium [CVE-2026-54183] Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

    Medium4.3

86. Aug 12, 2026
    Medium [CVE-2026-65017] Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

    Medium6.5

87. Aug 12, 2026
    Medium [CVE-2026-68969] Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

    Medium6.5

88. Aug 12, 2026
    Medium [CVE-2026-68970] Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

    Medium6.5

89. Aug 12, 2026
    Medium [CVE-2026-68971] Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

    Medium6.5

90. Aug 12, 2026
    Medium [CVE-2026-68076] Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

    Medium5.4

91. Aug 12, 2026
    Medium [CVE-2026-68868] Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

    Medium6.5

92. Aug 11, 2026
    Critical [CVE-2026-71290] Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

    Critical9.1

93. Aug 11, 2026
    Critical [CVE-2026-69223] Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF)

    Critical9.1

94. Aug 10, 2026
    Critical [CVE-2026-28672] Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger

    Critical9.8

95. Aug 10, 2026
    Critical [CVE-2026-32227] SQL Injection vulnerability vulnerability in Apache Ranger

    Critical9.8

96. Aug 10, 2026
    Critical [CVE-2026-40920] Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0

    Critical9.8

97. Aug 10, 2026
    Critical [CVE-2026-42537] Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue

    Critical9.8

98. Aug 10, 2026
    Critical [CVE-2026-44416] Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0

    Critical9.8

99. Aug 10, 2026
    Critical [CVE-2026-55799] Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue

    Critical9.8

100. Aug 10, 2026
     High [CVE-2026-61899] Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs

     High7.5

Page 1 of 2 · 100 of 168