Apache Seatunnel
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apache Seatunnel.
By the Year
In 2026 there have been 0 vulnerabilities in Apache Seatunnel. Last year, in 2025 Seatunnel had 1 security vulnerability published. Right now, Seatunnel is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 0.00 |
| 2024 | 2 | 7.50 |
It may take a day or so for new Seatunnel vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Seatunnel Security Vulnerabilities
Arbitrary File Read & Deserialization in SeaTunnel <=2.3.10
CVE-2025-32896
- June 19, 2025
# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
Missing Authentication for Critical Function
Apache SeaTunnel 1.0.0: Read-File via MySQL URL Parameters (before 1.0.1)
CVE-2023-49198
7.5 - High
- August 21, 2024
Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version [1.0.1], which fixes the issue.
Files or Directories Accessible to External Parties
Apache SeaTunnel 1.0.0 Hardcoded JWT Secret Allows Auth Bypass (Fixed in 1.0.1)
CVE-2023-48396
- July 30, 2024
Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue.
Authentication Bypass by Spoofing
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Seatunnel or by Apache? Click the Watch button to subscribe.
