HertzBeat vulnerabilities

9 known vulnerabilities in HertzBeat from Apache. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache HertzBeat: Improper Neutralization of Data within XPath Expressions

  CVE-2026-24343Feb 10, 2026Apache

  Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

• 8.8 High severity

  Apache HertzBeat (incubating): Improper Neutralization of Special Elements used in an LDAP Query

  CVE-2025-48208Sep 9, 2025Apache

  Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A succes

• 8.8 High severity

  Apache HertzBeat (incubating): XML Injection

  CVE-2025-24404Sep 9, 2025Apache

  XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This iss

• 7.5 High severity

  Apache HertzBeat: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-45791Nov 18, 2024Apache

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

• 8.8 High severity

  Apache HertzBeat: Improper Neutralization of Special Elements used in a Command

  CVE-2024-45505Nov 18, 2024ApacheEPSS 2.21%

  Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.1

• 8.8 High severity

  Apache HertzBeat: Deserialization of Untrusted Data

  CVE-2024-41151Nov 18, 2024Apache

  Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

• 8.8 High severity

  Apache HertzBeat: Deserialization of Untrusted Data

  CVE-2024-42323Sep 21, 2024ApacheEPSS 8.32%

  SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version

• 8.8 High severity

  HertzBeat: Deserialization of Untrusted Data

  CVE-2024-42362Aug 20, 2024ApacheEPSS 1.33%

  Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.

• 9.8 Critical severity

  HertzBeat: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-42361Aug 20, 2024ApacheEPSS 1.08%

  Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL