CVE-2025-54947: Apache StreamPark Hard-Coded Encryption Key Vulnerability
Summary
CVE-2025-54947: Apache StreamPark has a hard-coded encryption key. Affects org.apache.streampark:streampark versions >= 2.0.0, < 2.1.7. Fixed in 2.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache StreamPark is an open-source stream processing framework that enables users to build and manage real-time data processing applications. It provides features such as data ingestion, processing, and analytics, making it a popular choice for developers working with large-scale data streams. However, certain versions of StreamPark have a critical security flaw due to the use of a hard-coded encryption key, which can expose sensitive data to unauthorized access.
Vulnerability Detail
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability exists due to the implementation of a hard-coded encryption key. This fixed key can be exploited by attackers through reverse engineering or code analysis, allowing them to decrypt sensitive data or forge encrypted information. The implications of this vulnerability include potential information disclosure and unauthorized access to the system, which can lead to severe security breaches.
How To Fix
Minimum fixed version
2.1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The hard-coded encryption key vulnerability in Apache StreamPark poses significant security risks, including unauthorized access and data exposure. Users are strongly advised to upgrade to version 2.1.7 to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for org.apache.streampark:streampark →
FAQ
The vulnerability involves a hard-coded encryption key that can be exploited by attackers to decrypt sensitive data or forge encrypted information.
The vulnerability affects Apache StreamPark versions 2.0.0 through 2.1.7.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your 'pom.xml' file on the Vulert playground, you can quickly assess if your application is affected.
Upgrade to Apache StreamPark version 2.1.7 or later to eliminate the vulnerability.
There are no effective workarounds mentioned for this vulnerability. The recommended action is to upgrade to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.streampark:streampark.
