Apache StreamPark vulnerabilities

6 known vulnerabilities in Apache StreamPark from Apache. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache StreamPark: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2025-54981Dec 12, 2025Apache

  Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data This issue affects Apache StreamPark: f

• 9.8 Critical severity

  Apache StreamPark: Use of Hard-coded Credentials

  CVE-2025-54947Dec 12, 2025Apache

  In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely conf

• 7.3 High severity

  Apache StreamPark: Incorrect Execution-Assigned Permissions

  CVE-2025-30001Oct 10, 2025Apache

  Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue.

• 7.6 High severity

  Apache StreamPark: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-48988Aug 22, 2025Apache

  SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distribution package (SpringBoo

• 9.1 Critical severity

  On versions before 2.1.4, session is not invalidated after logout.

  CVE-2024-29070Jul 23, 2024Apache

  On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even af

• 8.8 High severity

  Apache StreamPark: Improper Control of Generation of Code

  CVE-2024-29178Jul 18, 2024ApacheEPSS 1.24%

  On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigati