Apache security advisories, September 2026

Apache advisories published in September 2026

1. Sep 17, 2026
   High [CVE-2026-92230] Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads

   High7.5

2. Sep 16, 2026
   Critical [CVE-2026-68536] Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core

   Critical9.8

3. Sep 16, 2026
   Critical [CVE-2026-76187] Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow

   Critical9.8

4. Sep 16, 2026
   Critical [CVE-2026-76186] Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two describe the same subject

   Critical9.1

5. Sep 16, 2026
   Critical [CVE-2026-82311 +1] Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions

   Critical9.1

6. Sep 16, 2026
   Critical [CVE-2026-82311 +1] Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does

   Critical9.8

7. Sep 16, 2026
   High [CVE-2026-70469] Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding

   High7.5

8. Sep 16, 2026
   High [CVE-2026-87976] Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests

   High7.2

9. Sep 16, 2026
   High [CVE-2026-76646] remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition

   High7.5

10. Sep 16, 2026
    High [CVE-2026-79993] Apache ZooKeeper: The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent

    High7.5

11. Sep 16, 2026
    High [CVE-2026-59969] Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

    High7.5

12. Sep 16, 2026
    High [CVE-2024-23944 +1] Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

    High7.5

13. Sep 16, 2026
    High [CVE-2026-75156 +1] Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts

    High8.1

14. Sep 16, 2026
    High [CVE-2026-82310] Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation

    High7.2

15. Sep 16, 2026
    High [CVE-2026-86792] Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them

    High8.8

16. Sep 16, 2026
    Medium [CVE-2026-82561] Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations

    Medium5.9

17. Sep 16, 2026
    Medium [CVE-2026-84501] unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",...) request containing newline characters (\n)

    Medium5.3

18. Sep 16, 2026
    Medium [CVE-2026-84439] When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username

    Medium5.3

19. Sep 16, 2026
    Medium [CVE-2026-68870 +3] Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key

    Medium6.5

20. Sep 16, 2026
    Low [CVE-2026-81866] Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration

    Low0.5

21. Sep 16, 2026
    Low [CVE-2026-86089] Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests

    Low2.3

22. Sep 14, 2026
    Critical [CVE-2026-82431] Apache Storm: Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered

    Critical9.8

23. Sep 14, 2026
    Critical [CVE-2026-82434] Apache Storm: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it

    Critical10.0

24. Sep 14, 2026
    Critical [CVE-2026-82435] Apache Storm: Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place

    Critical9.8

25. Sep 14, 2026
    Critical [CVE-2026-82439] Apache Storm: Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen

    Critical9.8

26. Sep 14, 2026
    Critical [CVE-2026-82441] A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs

    Critical9.1

27. Sep 14, 2026
    Critical [CVE-2026-73370] Incorrect Authorization vulnerability in Apache Syncope

    Critical9.8

28. Sep 14, 2026
    Critical [CVE-2026-73470] Improper Privilege Management vulnerability in Apache Syncope

    Critical9.8

29. Sep 14, 2026
    Critical [CVE-2026-73579] Incorrect Authorization vulnerability in Apache Syncope

    Critical9.8

30. Sep 14, 2026
    Critical [CVE-2026-75030] Missing Authorization vulnerability in Apache Syncope

    Critical9.8

31. Sep 14, 2026
    Critical [CVE-2026-77051] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope

    Critical9.8

32. Sep 14, 2026
    Critical [CVE-2026-73668] Incorrect Authorization vulnerability in Apache Syncope

    Critical9.8

33. Sep 14, 2026
    Critical [CVE-2026-77181] Incorrect Authorization vulnerability in Apache Syncope

    Critical9.8

34. Sep 14, 2026
    Critical [CVE-2026-78330] Incorrect privilege assignment vulnerability in Apache Syncope

    Critical9.8

35. Sep 14, 2026
    Critical [CVE-2026-82232] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope

    Critical9.8

36. Sep 14, 2026
    Critical [CVE-2026-86460] Apache Syncope: Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions

    Critical9.8

37. Sep 14, 2026
    Critical [CVE-2026-87785] Authentication bypass by spoofing vulnerability in Apache Syncope

    Critical9.1

38. Sep 14, 2026
    Critical [CVE-2026-87802] Improper verification of cryptographic signature vulnerability in Apache Syncope

    Critical9.1

39. Sep 14, 2026
    High [CVE-2026-82427] Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises

    High7.8

40. Sep 14, 2026
    High [CVE-2026-82428] Apache Storm: Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`

    High8.8

41. Sep 14, 2026
    High [CVE-2026-82429] Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0

    High7.8

42. Sep 14, 2026
    High [CVE-2026-82430] Apache Storm: Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory

    High7.8

43. Sep 14, 2026
    High [CVE-2026-82432] Apache Storm: Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only

    High8.1

44. Sep 14, 2026
    High [CVE-2026-82438] Apache Storm: Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user

    High8.1

45. Sep 14, 2026
    High [CVE-2026-73195] Improper Encoding or Escaping of Output vulnerability in Apache Syncope

    High7.3

46. Sep 14, 2026
    High [CVE-2026-73236] Incorrect Authorization vulnerability in Apache Syncope

    High7.5

47. Sep 14, 2026
    High [CVE-2026-73178] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope

    High7.5

48. Sep 14, 2026
    High [CVE-2026-78336] Insertion of sensitive information into sent data vulnerability in Apache Syncope

    High7.5

49. Sep 14, 2026
    High [CVE-2026-87779] Insertion of sensitive information into log file vulnerability in Apache Syncope

    High7.5

50. Sep 14, 2026
    High [CVE-2026-72524] Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to

    High8.8

51. Sep 14, 2026
    Medium [CVE-2026-82433] Apache Storm: Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check

    Medium6.5

52. Sep 14, 2026
    Medium [CVE-2026-82437] Apache Storm: Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content

    Medium4.3

53. Sep 14, 2026
    Medium [CVE-2026-82426] Apache Storm PMC: Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded

    Medium6.5PoC reported

54. Sep 14, 2026
    Medium [CVE-2026-84179] Apache Security Team: Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo

    Medium6.5

55. Sep 14, 2026
    Medium [CVE-2026-73191] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope

    Medium6.1

56. Sep 14, 2026
    Medium [CVE-2026-75015] Insufficiently Protected Credentials vulnerability in Apache Syncope

    Medium4.9

57. Sep 14, 2026
    Medium [CVE-2026-77147] Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope

    Medium6.5

58. Sep 14, 2026
    Medium [CVE-2026-77883] Exposure of sensitive information through data queries vulnerability in Apache Syncope

    Medium4.9

59. Sep 14, 2026
    Medium [CVE-2026-78318] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope

    Medium6.1

60. Sep 14, 2026
    Medium [CVE-2026-68570] Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information

    Medium6.5

61. Sep 11, 2026
    Critical [CVE-2026-82617] Apache OpenNLP: The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers

    Critical10.0

62. Sep 11, 2026
    High [CVE-2026-67211] OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4

    High7.5

63. Sep 10, 2026
    Critical [CVE-2026-80351] Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K

    Critical9.8

64. Sep 10, 2026
    Critical [CVE-2026-80352] Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K

    Critical9.8

65. Sep 10, 2026
    Critical [CVE-2026-84939] Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled)

    Critical9.1

66. Sep 10, 2026
    Critical [CVE-2026-49364] Apache Artemis: unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake

    Critical9.1

67. Sep 10, 2026
    Critical [CVE-2026-57967] Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

    Critical9.8

68. Sep 10, 2026
    Critical [CVE-2026-67593] Apache Artemis: remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter

    Critical9.1

69. Sep 10, 2026
    High [CVE-2026-80354] Authorization bypass through User-Controlled key vulnerability in Apache Camel K

    High8.1

70. Sep 10, 2026
    High [CVE-2026-49362] Apache Artemis: unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service

    High7.5

71. Sep 10, 2026
    High [CVE-2026-49363] Apache Artemis: unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication

    High7.5

72. Sep 10, 2026
    Medium [CVE-2026-57822] Apache Artemis: When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise

    Medium6.5

73. Sep 10, 2026
    Medium [CVE-2026-75880] Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

    Medium6.5

74. Sep 9, 2026
    Critical [CVE-2026-41871] Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API)

    Critical9.8

75. Sep 9, 2026
    Critical [CVE-2026-41869] Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API)

    Critical9.1

76. Sep 9, 2026
    Critical [CVE-2026-56207] Apache Impala: Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user

    Critical9.8

77. Sep 9, 2026
    High [CVE-2026-74761] Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms

    High7.5

78. Sep 9, 2026
    High [CVE-2026-73334] Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18

    High8.1

79. Sep 9, 2026
    High [CVE-2026-41870] Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API)

    High8.8

80. Sep 9, 2026
    High [CVE-2026-65181] Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code

    High8.1

81. Sep 9, 2026
    High [CVE-2026-57866] Server side request forgery in Apache Impala versions 4.4.x and 4.5.x

    High8.8

82. Sep 9, 2026
    Medium [CVE-2026-54048] Specifying tblproperties('avro.schema.url'=' http://...') or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages

    Medium5.3

83. Sep 8, 2026
    Critical [CVE-2026-59243 +1] Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

    Critical9.1

84. Sep 7, 2026
    High [CVE-2026-78254] The ftp and scp tasks of Apache Ant can download files from a remote server

    High7.4

85. Sep 4, 2026
    Critical [CVE-2026-80181] Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF)

    Critical9.1

86. Sep 4, 2026
    High [CVE-2026-52691] ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module

    High8.8

87. Sep 4, 2026
    High [CVE-2026-81270] Apache Allura: exposure of non-public information via search

    High7.5

88. Sep 4, 2026
    Medium [CVE-2026-80190] Apache Allura: stored XSS via SVN code repositories

    Medium6.1

89. Sep 4, 2026
    Medium [CVE-2025-54057 +1] ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI

    Medium6.1

90. Sep 4, 2026
    Medium [CVE-2026-71216] Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

    Medium5.3

91. Sep 4, 2026
    Medium [CVE-2026-80180] Stored XSS via markdown HTML processing in Apache Allura

    Medium6.1

92. Sep 2, 2026
    Medium [CVE-2026-32773] There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser

    Medium6.1

Page 2 of 2 · 92 of 192