PT-2025-50939 · Unknown · Apache Streampark

[e-mail] · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-54947

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions 2.0.0 through 2.1.7

Description A security issue exists due to the use of a hard-coded encryption key. The system employs a fixed, unchanging key for encryption, rather than dynamically generating or securely configuring it. An attacker could potentially obtain this key through reverse engineering or code analysis, which could lead to decryption of sensitive data or forging of encrypted information, resulting in information disclosure or unauthorized system access.

Recommendations Upgrade to version 2.1.7 to resolve the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2025-54947

GHSA-PRV5-C2PX-J9Q3

Affected Products

Apache Streampark

References · 7

• https://lists.apache.org/thread/kdntmzyzrco75x9q6mc6s8lty1fxmog1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54947 · Security Note
• http://openwall.com/lists/oss-security/2025/12/12/3 · Note
• https://twitter.com/oss_security/status/1999576692340240581 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1999554969683243313 · Twitter Post
• https://t.me/CVEtracker/39626 · Telegram Post