Read the docs
TI-2024-20197 Aliases CVE-2024-30471GHSA-2qph-v9p2-q2gv

Apache StreamPipes: Potential creation of multiple identical accounts

Priority LOW 31CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix Fixed org.apache.streampipes:streampipes-parent (Maven): 0.95.0streampipes (PyPI): 0.95.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache StreamPipesup to 0.93.0—No fix listedCNA
—org.apache.streampipes:streampipes-parent (Maven)before 0.95.00.95.0Patch availableGHSA-2qph-v9p2-q2gv
—streampipes (PyPI)before 0.95.00.95.0Patch availableGHSA-2qph-v9p2-q2gv
  • Apache StreamPipes VendorApache Affected up to 0.93.0 Fixed in — No fix listed CNA
  • org.apache.streampipes:streampipes-parent (Maven) Vendor— Affected before 0.95.0 Fixed in 0.95.0 Patch available GHSA-2qph-v9p2-q2gv
  • streampipes (PyPI) Vendor— Affected before 0.95.0 Fixed in 0.95.0 Patch available GHSA-2qph-v9p2-q2gv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:streampipes:*:*:*:*:*:*:*:*before 0.95.0VulnerableApache
  • cpe:2.3:a:apache:streampipes:*:*:*:*:*:*:*:* Versions before 0.95.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-2qph-v9p2-q2gv org.apache.streampipes:streampipes-parent (Maven) Fixed in 0.95.0 Advisory →
  • Fix · GHSA-2qph-v9p2-q2gv streampipes (PyPI) Fixed in 0.95.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-30471
  2. 2026-10-03 Alias added: GHSA-2qph-v9p2-q2gv
  3. 2026-10-07 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 4

  • TI-2024-19637 Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random… CVSS 3.1CRITICAL 9.1
  • TI-2025-29922 Apache StreamPipes: Leverage of User ID for Privilege Escalation CVSS 3.1HIGH 8.1
  • TI-2024-20782 Apache StreamPipes: Potential remote code execution (RCE) via file upload CVSS 3.1HIGH 8.8
  • TI-2023-15080 Apache StreamPipes: Privilege escalation through non-admin user CVSS 3.1HIGH 8.8
  • TI-2024-21078 Apache StreamPipes: Possibility of SSRF in pipeline element installation process CVSS 3.1HIGH 7.5
  • TI-2024-16295 Apache StreamPipes: Resources Permission Escalation CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences