CVE-2025-68637

CRITICAL9.1

Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client

Published Jan 7, 2026

Modified 1 months ago

Details

The Uniffle HTTP client is configured to trust all SSL certificates and

disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.

This issue affects all versions from before 0.10.0.

Users are recommended to upgrade to version 0.10.0, which fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2025/12/27/2

ADVISORY

https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-68637

CVSS Analysis

CVSS v3.1

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

9.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

Other

CWE-297

Ecosystems

Timeline

PublishedJan 7, 2026

ModifiedJan 7, 2026