Read the docs
TI-2026-25262 Aliases CVE-2026-32773GHSA-9437-39hj-3c93

Apache Spark: XSS Vulnerability in Spark Web 3.5.4

Priority LOW 27CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-80.

Summary

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 36th percentileScored 2026-11-07
Fix Partial Apache Spark (Apache Software Foundation): 3.5.8pyspark (PyPI): 3.5.8+2 more productsRed Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Spark3.0.0 to before 3.5.83.5.8Patch availableCNA
—pyspark (PyPI)3.0.0 to before 3.5.83.5.8Patch availableGHSA-9437-39hj-3c93
—org.apache.spark:spark-core_2.12 (Maven)3.0.0 to before 3.5.83.5.8Patch availableGHSA-9437-39hj-3c93
—org.apache.spark:spark-core_2.13 (Maven)3.0.0 to before 3.5.83.5.8Patch availableGHSA-9437-39hj-3c93
  • Apache Spark VendorApache Affected 3.0.0 to before 3.5.8 Fixed in 3.5.8 Patch available CNA
  • pyspark (PyPI) Vendor— Affected 3.0.0 to before 3.5.8 Fixed in 3.5.8 Patch available GHSA-9437-39hj-3c93
  • org.apache.spark:spark-core_2.12 (Maven) Vendor— Affected 3.0.0 to before 3.5.8 Fixed in 3.5.8 Patch available GHSA-9437-39hj-3c93
  • org.apache.spark:spark-core_2.13 (Maven) Vendor— Affected 3.0.0 to before 3.5.8 Fixed in 3.5.8 Patch available GHSA-9437-39hj-3c93

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*3.0.0 to before 3.5.8VulnerableApache
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.5.8 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Spark (Apache Software Foundation) Fixed in 3.5.8
  • Fix · GHSA-9437-39hj-3c93 pyspark (PyPI) Fixed in 3.5.8 Advisory →
  • Fix · GHSA-9437-39hj-3c93 org.apache.spark:spark-core_2.12 (Maven) Fixed in 3.5.8 Advisory →
  • Fix · GHSA-9437-39hj-3c93 org.apache.spark:spark-core_2.13 (Maven) Fixed in 3.5.8 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32773
  2. 2026-10-03 Alias added: GHSA-9437-39hj-3c93
  3. 2026-10-06 Fix available: Maven/org.apache.spark:[email protected], Maven/org.apache.spark:[email protected], PyPI/[email protected] · GHSA-9437-39hj-3c93
  4. 2026-10-06 CVSS score added · GHSA-9437-39hj-3c93
  5. 2026-10-06 Weakness changed · GHSA-9437-39hj-3c93
  6. 2026-10-06 9 new references · GHSA-9437-39hj-3c93
  7. 2026-10-07 EPSS moved to the below the 50th percentile
  8. 2026-10-07 Affected versions changed · Red Hat
  9. 2026-10-07 CVSS score added · Red Hat

References

Advisory 3

Other 6

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences