CVE Feed

    Dashboard / CVE / CVE-2026-32773

    CVE-2026-32773

    There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

    Published:Sep 2, 2026
    Last Modified:Sep 8, 2026
    EPS:Sep 2, 2026
    EPSS Score:0.00258
    CVSS Score:6.1

    Affected Products

    Vendor
    Apache
    Product
    Spark

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-54920 (CVSS 8.8) — This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or …
    CVE-2025-55039 (CVSS 6.5) — This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0…
    CVE-2024-23945 (CVSS 5.9) — Signing cookies is an application security feature that adds a digital signature to cookie data to verify its …
    CVE-2023-32007 (CVSS 8.8) — ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuratio…
    CVE-2023-22946 (CVSS 6.4) — In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
    CVE-2022-31777 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote …
    CVE-2022-33891 (CVSS 8.8) — The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With…
    CVE-2021-38296 (CVSS 7.5) — Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.cry…
    CVE-2020-27223 (CVSS 5.2) — In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a requ…
    CVE-2020-27218 (CVSS 4.8) — In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High