A security update fixes a critical privilege escalation vulnerability that could allow unauthorized users to gain administrative access to the Apache StreamPipes data streaming platform .
See also: Apache Tika: Risk from vulnerability that was fixed months ago
The issue, which has been documented as CVE-2025-47411 and is rated as critical, affects Apache StreamPipes versions 0.69.0 to 0.97.0.
The flaw is due to a flawed user ID generation mechanism, which allows holders of valid but non-administrative accounts to exploit manipulations of JWT tokens. By replacing their username with that of an existing administrator, attackers can escalate their privileges and gain full control of the application.
According to Apache's announcement, "a legitimate user with a non-administrator account can exploit a weakness in the user ID generation mechanism." This vulnerability allows access controls to be bypassed and unrestricted privileges to be gained on the system, posing serious risks to organizations using StreamPipes.
Once they gain administrative control, attackers can perform malicious actions, such as unauthorized access to data, corruption of critical information, modification of system settings, and potentially undermining the entire data flow infrastructure.
The attack does not require specialized technical knowledge or external tools, which makes it particularly dangerous for businesses that manage sensitive data flows.
See also: Apache ActiveMQ: Critical vulnerability allows arbitrary code execution
StreamPipes is used to create and execute data processing pipelines and often handles sensitive business data, further increasing the severity of the risk.
Compromised facilities could lead to the leakage of confidential information, business data, and customer details to unauthorized individuals.
This vulnerability also poses supply chain risks, particularly when StreamPipes is used in enterprise environments or is interconnected with critical business systems.
Apache has released version 0.98.0, which resolves the security issue. The security team strongly recommends that all users running affected versions immediately upgrade to version 0.98.0to eliminate the risk.
According to the relevant announcement by seclists.org, organizations should prioritize implementing the update, as the vulnerability is easily exploitable and poses a serious risk of compromising administrator accounts.
The vulnerability was discovered by Darren Xuan of Mantel Group, who received recognition for its responsible disclosure.
See also: Apache Tika: Critical Vulnerability in PDF Parser – Update now
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Security administrators are urged to immediately review the versions of StreamPipes they are using and schedule urgent update tasksin order to protect their streaming infrastructure from a potential breach.
