Read the docs
TI-2025-34667 Aliases CVE-2025-54947GHSA-prv5-c2px-j9q3

Apache StreamPark: Use hard-coded key vulnerability

Priority MEDIUM 49CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-321.

Summary

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Fix Fixed Apache StreamPark (Apache Software Foundation): 2.1.7org.apache.streampark:streampark (Maven): 2.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache StreamPark2.0.0 to before 2.1.72.1.7Patch availableCNA
—org.apache.streampark:streampark (Maven)2.0.0 to before 2.1.72.1.7Patch availableGHSA-prv5-c2px-j9q3
  • Apache StreamPark VendorApache Affected 2.0.0 to before 2.1.7 Fixed in 2.1.7 Patch available CNA
  • org.apache.streampark:streampark (Maven) Vendor— Affected 2.0.0 to before 2.1.7 Fixed in 2.1.7 Patch available GHSA-prv5-c2px-j9q3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*2.0.0 to before 2.1.7VulnerableApache
  • cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.1.7 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache StreamPark (Apache Software Foundation) Fixed in 2.1.7
  • Fix · GHSA-prv5-c2px-j9q3 org.apache.streampark:streampark (Maven) Fixed in 2.1.7 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache StreamPark 2.1.7

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-34690 Apache StreamPark: Weak Encryption Algorithm in StreamParkPriority LOW 38
    • TI-2025-33818 Apache StreamPark: Uses the user’s password as the secret keyPriority LOW 26
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54947
  2. 2026-10-03 Alias added: GHSA-prv5-c2px-j9q3

References

Advisory 2

Other 3

  • TI-2022-22606 Apache StreamPark (incubating): Upload any file to any directory CVSS 3.1CRITICAL 9.8
  • TI-2024-19248 Apache StreamPark: session not invalidated after logout CVSS 3.1CRITICAL 9.1
  • TI-2022-22908 Apache StreamPark (incubating): Logic error causing any account reset CVSS 3.1CRITICAL 9.1
  • TI-2024-19347 Apache StreamPark: FreeMarker SSTI RCE Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-28690 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution CVSS 3.1HIGH 8.8
  • TI-2024-19513 Apache StreamPark (incubating): maven build params could trigger remote command execution CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences