Loading story…
A critical vulnerability, tracked as CVE-2025-54947, was discovered in Apache StreamPark, a widely used stream-processing platform. The flaw arises from the use of a hard-coded encryption key and insecure AES ECB mode, allowing attackers to decrypt sensitive data, forge authentication tokens, and potentially gain unauthorized access to affected systems. The vulnerability impacts versions 2.0.0 through 2.1.7, exposing organizations to significant risks of information disclosure and privilege escalation if left unpatched.
The Apache StreamPark development team has addressed the issue by releasing version 2.1.7, which eliminates the hard-coded key vulnerability. Security experts strongly advise organizations to upgrade to the latest version immediately and conduct thorough security audits of their StreamPark deployments to identify and mitigate any potential compromise resulting from this flaw. Failure to patch could allow threat actors to manipulate system behavior or escalate privileges within enterprise environments relying on StreamPark for real-time data processing.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Apache StreamPark team released version 2.1.7 to fix CVE-2025-54947 and advised users to upgrade immediately. Reporting also recommended auditing affected environments for possible data exposure and reviewing key management practices.
A vulnerability affecting Apache StreamPark versions 2.0.0 through 2.1.7 was identified, caused by a hard-coded cryptographic key and use of insecure AES ECB mode. The issue could allow attackers to decrypt sensitive data and forge authentication tokens, leading to unauthorized access or privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical privilege escalation vulnerability, tracked as CVE-2025-47411, was discovered in Apache StreamPipes versions 0.69.0 through 0.97.0. The flaw allows legitimate non-administrator users to manipulate JWT tokens and escalate their privileges by swapping their username for an existing administrator account, thereby gaining full administrative control of the application. This vulnerability stems from a flawed user ID creation mechanism and poses significant risks, as attackers can bypass access controls without advanced technical skills or external tools. Once administrative access is obtained, attackers can access sensitive data, modify system configurations, and potentially compromise the entire data streaming infrastructure. The vulnerability is particularly concerning for organizations using StreamPipes to process proprietary or operational data, and it introduces supply chain risks if integrated with critical business systems. Apache has addressed the issue by releasing version 0.98.0, urging all affected users to update immediately to mitigate the risk.
Jun 29, 2026
CERT Polska disclosed **CVE-2026-50641**, a plaintext password storage vulnerability in **Streamsoft Business Intelligence** that caused user passwords to be stored unprotected in the product database. The issue, classified as **CWE-256**, affects all versions prior to **6.8.0.0** and exposes credentials to anyone able to access the underlying database. Streamsoft remediated the flaw in version **6.8.0.0** following coordinated disclosure with CERT Polska. After applying the update, users are required to change their password at first login, a step intended to reduce the risk from credentials that may have been previously stored in plaintext.
Jul 30, 2026
A critical flaw tracked as **`CVE-2026-59099`** was disclosed in **Apereo CAS**, the open-source single sign-on platform, affecting versions **7.3.0 through 8.0.0-RC5**. The bug stems from **AES-GCM nonce reuse** caused by a fixed all-zero IV being used with the same encryption key for the life of the server, allowing an unauthenticated remote attacker to collect client-side webflow execution tokens from the login page and use known-plaintext techniques to decrypt webflow conversation state. The issue can expose sensitive session, identity, and application data, and was rated **critical** with **CVSS 4.0 9.3** and **CVSS 3.1 9.1**. The disclosure highlights how cryptographic implementation mistakes can turn protected traffic or tokens into recoverable plaintext, echoing earlier SSL/TLS weaknesses such as attacks against **RC4** that similarly enabled partial plaintext recovery from encrypted sessions. Apereo was notified on June 16, fixed the issue on June 17, and released patched versions on June 18; affected organizations were urged to upgrade to **`8.0.0-RC6`** or the relevant patch release and to rotate signing and encryption keys if they had operated vulnerable deployments.
Jul 12, 2026