CVE-2025-26866

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/incubator-hugegraph/pull/2735	Issue Tracking Patch
https://lists.apache.org/thread/ko8jkwbjbb99m45pg4sgo5xsm8gx9nsq	Mailing List
http://www.openwall.com/lists/oss-security/2025/12/09/1	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de ejecución remota de código donde un nodo Raft malicioso puede explotar la deserialización Hessian insegura dentro del almacén PD. La solución aplica autenticación basada en IP para restringir la membresía del clúster e implementa una lista blanca de clases estricta para fortalecer el proceso de serialización Hessian contra ataques de inyección de objetos. Se recomienda a los usuarios actualizar a la versión 1.7.0, que soluciona el problema.

Information

Published : 2025-12-12 10:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-26866

Mitre link : CVE-2025-26866

CVE.ORG link : CVE-2025-26866

JSON object : View

Products Affected

apache

hugegraph

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-26866", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-26866", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-13T04:55:18.474461Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache HugeGraph-Server", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.7.0", "versionType": "maven"}], "packageName": "org.apache.hugegraph:hugegraph", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2025-12-12T10:15:49.053", "references": [{"url": "https://github.com/apache/incubator-hugegraph/pull/2735", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/ko8jkwbjbb99m45pg4sgo5xsm8gx9nsq", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/12/09/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.\n\n\n\n\nUsers are recommended to upgrade to version 1.7.0, which fixes the issue."}, {"lang": "es", "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo donde un nodo Raft malicioso puede explotar la deserializaci\u00f3n Hessian insegura dentro del almac\u00e9n PD. La soluci\u00f3n aplica autenticaci\u00f3n basada en IP para restringir la membres\u00eda del cl\u00faster e implementa una lista blanca de clases estricta para fortalecer el proceso de serializaci\u00f3n Hessian contra ataques de inyecci\u00f3n de objetos.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.7.0, que soluciona el problema."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9C85CC8-1E1D-46F2-BB0C-9A85C78347C8", "versionEndExcluding": "1.7.0", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}