Loading story…
A critical privilege escalation vulnerability, tracked as CVE-2025-47411, was discovered in Apache StreamPipes versions 0.69.0 through 0.97.0. The flaw allows legitimate non-administrator users to manipulate JWT tokens and escalate their privileges by swapping their username for an existing administrator account, thereby gaining full administrative control of the application. This vulnerability stems from a flawed user ID creation mechanism and poses significant risks, as attackers can bypass access controls without advanced technical skills or external tools.
Once administrative access is obtained, attackers can access sensitive data, modify system configurations, and potentially compromise the entire data streaming infrastructure. The vulnerability is particularly concerning for organizations using StreamPipes to process proprietary or operational data, and it introduces supply chain risks if integrated with critical business systems. Apache has addressed the issue by releasing version 0.98.0, urging all affected users to update immediately to mitigate the risk.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Public reports stated that proof-of-concept exploit details for CVE-2025-47411 were already circulating, increasing the risk of real-world exploitation. Coverage emphasized the flaw's low complexity and the potential for unauthorized data access and system compromise.
Apache released StreamPipes version 0.98.0 to address CVE-2025-47411, a flaw that let non-admin users escalate privileges to full admin access. Organizations were advised to upgrade immediately and review deployments for possible exposure.
Darren Xuan of Mantel Group responsibly disclosed a critical privilege-escalation flaw in Apache StreamPipes, tracked as CVE-2025-47411. The vulnerability affects versions 0.69.0 through 0.97.0 and allows standard users to gain administrative control by manipulating JWT tokens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcetechrepublic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-54947, was discovered in Apache StreamPark, a widely used stream-processing platform. The flaw arises from the use of a hard-coded encryption key and insecure AES ECB mode, allowing attackers to decrypt sensitive data, forge authentication tokens, and potentially gain unauthorized access to affected systems. The vulnerability impacts versions 2.0.0 through 2.1.7, exposing organizations to significant risks of information disclosure and privilege escalation if left unpatched. The Apache StreamPark development team has addressed the issue by releasing version 2.1.7, which eliminates the hard-coded key vulnerability. Security experts strongly advise organizations to upgrade to the latest version immediately and conduct thorough security audits of their StreamPark deployments to identify and mitigate any potential compromise resulting from this flaw. Failure to patch could allow threat actors to manipulate system behavior or escalate privileges within enterprise environments relying on StreamPark for real-time data processing.
Jun 29, 2026
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026
Attackers are actively exploiting **CVE-2026-5430**, a CVSS 10 authentication-bypass vulnerability affecting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The flaw results from improper JWT signature verification: vulnerable services accept tokens signed with unsupported algorithms, allowing attackers to forge JWTs with administrator privileges and bypass authentication. WatchTowr recorded exploitation attempts against its honeypots using forged administrative tokens. Successful compromise can enable full administrative account takeover and expose API backend endpoints, registered application credentials, consumer keys, and other secrets. Attackers may also be able to intercept data in transit and access internal services reachable through affected API deployments. WSO2 released fixes in April 2026 through community pull requests and subscription update levels; organizations should apply the relevant updates immediately and investigate WSO2 environments for unauthorized administrator tokens or account activity.
Sep 16, 2026