CVE-2025-26866: Apache HugeGraph-Server RAFT and Deserialization Vulnerability
Summary
CVE-2025-26866: Apache HugeGraph-Server: RAFT and deserialization vulnerability. Affects org.apache.hugegraph:hg-pd-core versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HugeGraph is an open-source graph database designed for handling large-scale graph data. It provides a distributed architecture that supports various graph operations and queries. The HugeGraph-Server component utilizes the RAFT consensus algorithm for cluster management and data consistency. However, it has been found vulnerable to a remote code execution issue due to insecure Hessian deserialization, which can be exploited by malicious nodes within the cluster.
Vulnerability Detail
A remote code execution vulnerability exists in Apache HugeGraph-Server where a malicious RAFT node can exploit insecure Hessian deserialization within the PD store. This vulnerability arises from the lack of proper validation and authentication mechanisms, allowing attackers to inject malicious objects during the deserialization process. If exploited, this could lead to unauthorized access and control over the server, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
1.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the HugeGraph-Server by implementing network-level controls, such as firewalls, to limit communication to trusted IP addresses until the upgrade can be performed.
Conclusion
The CVE-2025-26866 vulnerability in Apache HugeGraph-Server poses significant risks due to insecure Hessian deserialization. Users are strongly advised to upgrade to version 1.7.0 to mitigate these risks and ensure the security of their graph database systems.
See every vulnerability recorded for org.apache.hugegraph:hg-pd-core →
FAQ
The vulnerability allows remote code execution through insecure Hessian deserialization, which can be exploited by malicious nodes in the RAFT cluster.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground without signup to test your application.
Failure to address this vulnerability could lead to unauthorized access and control over the HugeGraph-Server, resulting in potential data breaches and system compromise.
Yes, a patch is available in version 1.7.0 of the org.apache.hugegraph:hg-pd-core package, which addresses the vulnerability.
After upgrading, ensure that IP-based authentication is configured correctly and monitor your system for any unusual activity to maintain security.
