CVE-2025-9571

A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. This could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure. The following CDAP versions include the necessary update to protect against this vulnerability: * 6.10.6+ * 6.11.1+ Users must immediately upgrade to them, or greater ones, available at: https://github.com/cdapio/cdap-build/releases .

CVSS

No CVSS.

References

Link	Resource
https://docs.cloud.google.com/support/bulletins#gcp-2025-076

Configurations

No configuration.

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de ejecución remota de código (RCE) existe en Google Cloud Data Fusion. Un usuario con permisos para cargar artefactos a una instancia de Data Fusion puede ejecutar código arbitrario dentro del componente central de AppFabric. Esto podría permitir al atacante obtener control sobre la instancia de Data Fusion, lo que podría llevar a acceso no autorizado a datos sensibles, modificación de pipelines de datos y exploración de la infraestructura subyacente. Las siguientes versiones de CDAP incluyen la actualización necesaria para protegerse contra esta vulnerabilidad: * 6.10.6+ * 6.11.1+ Los usuarios deben actualizarse inmediatamente a ellas, o a versiones superiores, disponibles en: https://github.com/cdapio/cdap-build/releases.

Information

Published : 2025-12-10 07:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-9571

Mitre link : CVE-2025-9571

CVE.ORG link : CVE-2025-9571

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-9571", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9571", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-10T15:07:00.580352Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "affectedData": [{"vendor": "Google Cloud", "product": "Cloud Data Fusion", "versions": [{"status": "affected", "version": "0", "lessThan": "6.10.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "6.11.1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-10T07:15:57.820", "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2025-076", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.\nA user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. \nThis could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.\n\nThe following CDAP versions include the necessary update to protect against this vulnerability: * 6.10.6+\n * 6.11.1+\n\n\n\n\u00a0Users must immediately\u00a0upgrade to them, or greater ones, available at: https://github.com/cdapio/cdap-build/releases ."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) existe en Google Cloud Data Fusion.\nUn usuario con permisos para cargar artefactos a una instancia de Data Fusion puede ejecutar c\u00f3digo arbitrario dentro del componente central de AppFabric.\nEsto podr\u00eda permitir al atacante obtener control sobre la instancia de Data Fusion, lo que podr\u00eda llevar a acceso no autorizado a datos sensibles, modificaci\u00f3n de pipelines de datos y exploraci\u00f3n de la infraestructura subyacente.\n\nLas siguientes versiones de CDAP incluyen la actualizaci\u00f3n necesaria para protegerse contra esta vulnerabilidad:\n* 6.10.6+\n* 6.11.1+\n\nLos usuarios deben actualizarse inmediatamente a ellas, o a versiones superiores, disponibles en: https://github.com/cdapio/cdap-build/releases."}], "lastModified": "2026-09-25T23:10:00.463", "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}