Apache StreamPipes には権限管理の不備があります

The core impact of CVE-2025-47411 lies in the potential for unauthorized privilege escalation. An attacker, posing as a regular user, can exploit this vulnerability to assume the identity and permissions of an administrator within the Apache StreamPipes system. This grants them the ability to modify configurations, access sensitive data, and potentially compromise the entire platform. The manipulation of JWT tokens is a key component of this attack, enabling the attacker to impersonate an administrator without proper authentication. The blast radius extends to any data processed or managed by StreamPipes, as an administrator can access and alter it.

Organizations utilizing Apache StreamPipes for data processing and analytics are at risk, particularly those relying on the platform for critical business operations. Environments with weak user access controls or inadequate JWT token security practices are especially vulnerable. Shared hosting environments where multiple users share the same StreamPipes instance should be prioritized for patching.

• java / server:

find /opt/streampipes -type f -name '*.jar' -print0 | xargs -0 grep -i 'user id creation mechanism'

• java / supply-chain: Review dependencies for known vulnerabilities using tools like OWASP Dependency-Check. • generic web: Monitor Apache StreamPipes access logs for unusual user login patterns or attempts to modify user profiles. • database (mysql, postgresql): Inspect StreamPipes database for suspicious user entries or altered permissions.

1. 2026-01-01Disclosure

   disclosure

1. 予約済み2025-05-06
2. 公開日2026-01-01
3. 更新日2026-02-03
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-47411 is to upgrade Apache StreamPipes to version 0.98.0, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Review user account permissions and restrict access to sensitive functionalities. Implement stricter JWT token validation and rotation policies to minimize the impact of token manipulation. Monitor user activity logs for suspicious behavior, particularly any attempts to modify user profiles or access administrative functions. After upgrading to 0.98.0, confirm the fix by attempting a username swap with a non-administrator account; the operation should fail.