Read the docs
TI-2018-08427 Aliases CVE-2018-11770GHSA-w4r4-65mg-45x2

Improper authentication in Apache Spark

Priority MEDIUM 56CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.

Why it matters now

EPSS 0.66067 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Apache Spark (Apache Software Foundation): 2.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Spark1.3.0 to before 2.4.02.4.0Patch availableCNA
—org.apache.spark:spark-core_2.11 (Maven)1.0.0 – 2.3.2—No fix listedGHSA-w4r4-65mg-45x2
—org.apache.spark:spark-core_2.10 (Maven)1.0.0 – 2.2.2—No fix listedGHSA-w4r4-65mg-45x2
  • Apache Spark VendorApache Affected 1.3.0 to before 2.4.0 Fixed in 2.4.0 Patch available CNA
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected 1.0.0 – 2.3.2 Fixed in — No fix listed GHSA-w4r4-65mg-45x2
  • org.apache.spark:spark-core_2.10 (Maven) Vendor— Affected 1.0.0 – 2.2.2 Fixed in — No fix listed GHSA-w4r4-65mg-45x2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*1.3.0 to before 2.4.0VulnerableApache
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions 1.3.0 to before 2.4.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Spark (Apache Software Foundation) Fixed in 2.4.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Fuse 7
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11770
  2. 2026-10-03 Alias added: GHSA-w4r4-65mg-45x2

References

Exploit 1

Advisory 2

Other 2

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-12289 In all versions of Apache Spark, its standalone resource manager accepts code to execute… CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences