Read the docs
TI-2018-12289 Aliases CVE-2018-17190GHSA-phg2-9c5g-m4q7

In all versions of Apache Spark, its standalone resource manager accepts code to execute…

Priority MEDIUM 53Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.

Why it matters now

EPSS 0.08792 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache SparkAll versions—No fix listedCNA
—org.apache.spark:spark-core_2.11 (Maven)all versions—No fix listedGHSA-phg2-9c5g-m4q7
—org.apache.spark:spark-core_2.10 (Maven)all versions—No fix listedGHSA-phg2-9c5g-m4q7
  • Apache Spark VendorApache Affected All versions Fixed in — No fix listed CNA
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-phg2-9c5g-m4q7
  • org.apache.spark:spark-core_2.10 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-phg2-9c5g-m4q7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*all versionsVulnerableApache
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-17190
  2. 2026-10-03 Alias added: GHSA-phg2-9c5g-m4q7

References

Advisory 3

Other 3

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences