Loading vulnerability…
Apache Uniffle HTTP Client TLS Verification Bypass / MITM Exposure
CVE-2025-68637 is a critical vulnerability in Apache Uniffle affecting all versions prior to 0.10.0. The Uniffle HTTP client used by the CLI/client is configured insecurely by default to trust all SSL/TLS certificates and to disable hostname verification. As a result, REST API communications between the Uniffle CLI/client and the Uniffle Coordinator service are not properly authenticated at the TLS layer. This allows an attacker positioned on the network path to present an arbitrary certificate and impersonate the Coordinator service, enabling a man-in-the-middle attack against client-to-Coordinator traffic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful exploit allows interception and tampering of REST API traffic between the Uniffle CLI/client and the Uniffle Coordinator. The primary impact is loss of confidentiality and integrity of those communications: an attacker can eavesdrop on sensitive data in transit, modify requests or responses, and potentially impersonate the Coordinator service to connected clients. The supplied content does not indicate a direct availability impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, avoid using affected Uniffle clients over untrusted or shared networks. Restrict client-to-Coordinator communication to trusted network paths such as private networking or VPNs, and apply compensating controls including network segmentation and monitoring to reduce exposure to on-path attackers. Where configurable, enforce proper certificate validation and hostname verification rather than trusting all certificates.
Patch, then assume compromise.
Upgrade Apache Uniffle to version 0.10.0 or later. According to the provided advisory content, version 0.10.0 fixes the insecure HTTP client TLS behavior by correcting certificate trust handling and hostname verification.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.