CVE-2025-26866 json
Apache HugeGraph-Server: RAFT and deserialization vulnerability
published 2025-12-12 10 mo ago modified 2026-10-07 32 d ago also EUVD-2025-203068 , GHSA-q37j-3367-fwv7
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
Patch / fix
- maven org.apache.hugegraph:hg-pd-core 1.7.0
- Apache Software Foundation Apache HugeGraph-Server 1.7.0
- github.com/apache/incubator-hugegraph#2735 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.hugegraph:hg-pd-core | <1.7.0 |
1.7.0 |
Affected products
- Apache Software Foundation Apache HugeGraph-Server
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/incubator-hugegraph/pull/2735
patch, web, issue-tracking
-
lists.apache.org
/thread/ko8jkwbjbb99m45pg4sgo5xsm8gx9nsq
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2025/12/09/1
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2025-26866
advisory
-
github.com
/apache/incubator-hugegraph
package
Sources
- CVE List CVE-2025-26866
- GitHub Advisory GHSA-q37j-3367-fwv7
- NVD CVE-2025-26866
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.