CVE-2025-30001: Apache StreamPark Incorrect Execution-Assigned Permissions Vulnerability
Summary
CVE-2025-30001: Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability. Affects org.apache.streampark:streampark versions < 2.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache StreamPark is an open-source project designed for stream processing, providing a unified framework for batch and stream data processing. It allows developers to build and manage data pipelines efficiently. However, like many software packages, it can be susceptible to vulnerabilities that may compromise its security and functionality.
Vulnerability Detail
The vulnerability identified as CVE-2025-30001 in Apache StreamPark is an Incorrect Execution-Assigned Permissions issue. This flaw arises from improper handling of permissions during execution, potentially allowing unauthorized users to gain elevated access to certain functionalities. The vulnerability affects versions from 2.1.4 up to, but not including, 2.1.6. If exploited, it could lead to unauthorized actions being performed within the application, posing significant security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as it becomes available.
Conclusion
In summary, CVE-2025-30001 is a significant vulnerability in Apache StreamPark that can lead to unauthorized access due to incorrect execution-assigned permissions. Users are strongly advised to upgrade to version 2.1.6 or later to ensure their applications remain secure.
See every vulnerability recorded for org.apache.streampark:streampark →
FAQ
CVE-2025-30001 is a vulnerability in Apache StreamPark that involves incorrect execution-assigned permissions, potentially allowing unauthorized access.
Versions from 2.1.4 up to, but not including, 2.1.6 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just your pom.xml. You can check your application at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 7.3, indicating a high severity level.
While there are no specific workarounds, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.streampark:streampark.
