Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client

published 2026-01-07 10 mo ago modified 2026-10-07 32 d ago also EUVD-2026-1226

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

The Uniffle HTTP client is configured to trust all SSL certificates and

disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.

This issue affects all versions from before 0.10.0.

Users are recommended to upgrade to version 0.10.0, which fixes the issue.

Patch / fix

fixed in 1

Apache Software Foundation Apache Uniffle 0.10.0

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 10 mo ago (2026-01-07)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Apache Software Foundation Apache Uniffle

Classification

Weakness

CWE-297 Improper Validation of Certificate with Host Mismatch

References

lists.apache.org /thread/trvdd11hmpbjno3t8rc9okr4t036ox2v
vendor-advisory, issue-tracking, mailing-list
openwall.com /lists/oss-security/2025/12/27/2
mailing-list, third-party-advisory

Sources

CVE List CVE-2025-68637
NVD CVE-2025-68637

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary