CVE-2025-68637
Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client
- State
- Published
- Severity
- 9.1 Critical
- Published
- Jan 7, 2026
- Updated
- Jan 7, 2026
- Reserved
- Dec 20, 2025
Description
The Uniffle HTTP client is configured to trust all SSL certificates and
disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.
This issue affects all versions from before 0.10.0.
Users are recommended to upgrade to version 0.10.0, which fixes the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-297 Improper Validation of Certificate with Host Mismatch
Affected Products
| Product | Versions |
|---|---|
Apache UniffleApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.