CVE-2025-60012: Apache Livy Unauthorized File Access Vulnerability
Summary
CVE-2025-60012: Apache Livy: Restrict file access. Affects org.apache.livy:livy-server versions >= 0.7.0-incubating, < 0.9.0-incubating. Fixed in 0.9.0-incubating. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Livy is an open-source project that provides a REST interface for interacting with Apache Spark. It allows users to submit Spark jobs, manage sessions, and interact with Spark's capabilities through a simplified API. However, certain configurations in Livy can lead to unauthorized file access, particularly when used with Spark versions 3.1 or later.
Vulnerability Detail
The vulnerability arises from a malicious configuration that can allow unauthorized access to files within the Apache Livy environment. Specifically, when users connect to Apache Spark 3.1 or later, a request containing arbitrary Spark configuration values can lead to unauthorized file access. For exploitation, the attacker must have access to Livy's REST or JDBC interface, enabling them to send crafted requests that bypass file access controls. This could result in sensitive data exposure or unauthorized data manipulation.
How To Fix
Minimum fixed version
0.9.0-incubating
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should restrict access to the Livy REST and JDBC interfaces to trusted users only, and avoid using arbitrary Spark configuration values in requests until the upgrade is completed.
Conclusion
The CVE-2025-60012 vulnerability in Apache Livy poses a risk of unauthorized file access due to misconfigurations when used with Apache Spark 3.1 or later. Users are strongly advised to upgrade to version 0.9.0 or later to mitigate this risk. Additionally, implementing access restrictions and using Vulert for monitoring can enhance security.
See every vulnerability recorded for org.apache.livy:livy-server →
FAQ
Apache Livy versions 0.7.0 and 0.8.0 are affected when connecting to Apache Spark 3.1 or later.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, data exposure, and potential data manipulation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.livy:livy-server.
