Hugegraph vulnerabilities

4 known vulnerabilities in Hugegraph from Apache. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache HugeGraph-Server: Deserialization of Untrusted Data

  CVE-2025-26866Dec 12, 2025ApacheEPSS 1.11%

  A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden

• 9.8 Critical severity

  Apache HugeGraph-Server: Authentication Bypass by Assumed-Immutable Data

  CVE-2024-43441Dec 24, 2024ApacheEPSS 73.1%

  Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

• 9.1 Critical severity

  Apache HugeGraph-Server: Authentication Bypass by Spoofing

  CVE-2024-27349Apr 22, 2024ApacheEPSS 1.02%

  Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

• 9.8 Critical severity

  Apache HugeGraph-Server Improper Access Control Exploited

  CVE-2024-27348Apr 22, 2024ApacheEPSS 99.2%

  RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the