Origin validation error in Apache Knox
Priority LOW 31CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be easily associated with the authenticated user, this is still a serious security issue. All users are recommended to upgrade to the Apache Knox 0.12.0 release.
Why it matters now
EPSS 0.00752 55th percentileScored 2026-11-07
Fix Fixed org.apache.knox:gateway-provider-identity-assertion-common (Maven): 0.12.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Knox | 0.2.0 to 0.11.0 | — | No fix listed | CNA |
| — | org.apache.knox:gateway-provider-identity-assertion-common (Maven) | 0.2.0 to before 0.12.0 | 0.12.0 | Patch available | GHSA-g3fc-8jv4-qmmv |
- Apache Knox VendorApache Affected 0.2.0 to 0.11.0 Fixed in — No fix listed CNA
- org.apache.knox:gateway-provider-identity-assertion-common (Maven) Vendor— Affected 0.2.0 to before 0.12.0 Fixed in 0.12.0 Patch available GHSA-g3fc-8jv4-qmmv
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:knox:0.2.0:*:*:*:*:*:*:* | 0.2.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.3.0:*:*:*:*:*:*:* | 0.3.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.4.0:*:*:*:*:*:*:* | 0.4.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.5.0:*:*:*:*:*:*:* | 0.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.6.0:*:*:*:*:*:*:* | 0.6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.7.0:*:*:*:*:*:*:* | 0.7.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.8.0:*:*:*:*:*:*:* | 0.8.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.9.0:*:*:*:*:*:*:* | 0.9.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.10.0:*:*:*:*:*:*:* | 0.10.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:knox:0.11.0:*:*:*:*:*:*:* | 0.11.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:knox:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.3.0:*:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·Apache
- cpe:2.3:a:apache:knox:0.11.0:*:*:*:*:*:*:* Versions 0.11.0 Vulnerable ·Apache
Remediation
- Fix · GHSA-g3fc-8jv4-qmmv org.apache.knox:gateway-provider-identity-assertion-common (Maven) Fixed in 0.12.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5646
- 2026-10-03 Alias added: GHSA-g3fc-8jv4-qmmv
References
Advisory 2
More Apache Knox vulnerabilities
- TI-2021-18773 DOM based XSS Vulnerability in Apache Knox CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-5646 · CVE Program
- CVE-2017-5646 · NVD
- FIRST EPSS
- GHSA-g3fc-8jv4-qmmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences