GHSA-3hg2-rh4r-8qf6
Medium · 5.9CVSS
5.9
EPSS
—
Published
Dec 12, 2025
CISA due date
—
The record
Apache StreamPark: Use the user’s password as the secret key Vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.streampark:streampark | 2.0.0 | 2.1.7 |
| maven | org.apache.streampark/streampark | 2.0.0 | 2.1.7 |
Related vulnerabilities
- CVE-2025-53960 Apache StreamPark: Use the user’s password as the secret key Vulnerability Same vulnerability
- GHSA-749j-2hp6-8cxm Apache StreamPark uses a Weak Encryption Algorithm Also affects org.apache.streampark:streampark
- GHSA-prv5-c2px-j9q3 Apache StreamPark has a hard-coded encryption key Also affects org.apache.streampark:streampark
- CVE-2025-54947 Apache StreamPark has a hard-coded encryption key Also affects org.apache.streampark:streampark
- CVE-2025-54981 Apache StreamPark uses a Weak Encryption Algorithm Also affects org.apache.streampark:streampark
- CVE-2026-50303 Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows… CWE-1240
- CVE-2026-46654 Plonky3 is a toolkit for polynomial IOPs (PIOPs). CWE-1240
- CVE-2026-44410 This vulnerability stems from a business logic flaw.Attackers can exploit legitimate… CWE-1240