TI-2025-19737 Aliases CVE-2025-26866 GHSA-q37j-3367-fwv7

Apache HugeGraph-Server: RAFT and deserialization vulnerability

MEDIUM 48CWE-502Published 2025-12-12 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01044 64th percentileScored 2026-11-07

Fix Fixed Apache HugeGraph-Server (Apache Software Foundation): 1.7.0org.apache.hugegraph:hg-pd-core (Maven): 1.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache HugeGraph-Server	1.0.0 to before 1.7.0	1.7.0	Patch available	CNA
—	org.apache.hugegraph:hg-pd-core (Maven)	before 1.7.0	1.7.0	Patch available	GHSA-q37j-3367-fwv7

Apache HugeGraph-Server VendorApache Affected 1.0.0 to before 1.7.0 Fixed in 1.7.0 Patch available CNA
org.apache.hugegraph:hg-pd-core (Maven) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-q37j-3367-fwv7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:hugegraph::::::::	1.0.0 to before 1.7.0	Vulnerable	Apache

cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.7.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache HugeGraph-Server (Apache Software Foundation) Fixed in 1.7.0
Fix · GHSA-q37j-3367-fwv7 org.apache.hugegraph:hg-pd-core (Maven) Fixed in 1.7.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-26866
2026-10-03 Alias added: GHSA-q37j-3367-fwv7

References

Patch 1

https://github.com/apache/incubator-hugegraph/pull/2735

Advisory 2

Other 2

TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
TI-2024-29087 Apache HugeGraph-Server: Fixed JWT Token(Secret) CVSS 3.1CRITICAL 9.8
TI-2024-18187 Apache HugeGraph-Server: Bypass whitelist in Auth mode CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences