CVE-2026-32773
Last modified
CVE-2026-32773 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Spark | >= 3.0.0, < 3.5.8 |
References
- https://lists.apache.org/thread/k36prh3oxl1z6ov7w8rpmfnt07hmzw3vMailing List, Vendor Advisory
- https://www.openwall.com/lists/oss-security/2026/09/01/4Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-32773?
How severe is CVE-2026-32773?
How do I fix CVE-2026-32773?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32768Chall-Manager is a platform-agnostic system able to start Ch…9.9
- CVE-2026-32769Fullchain is an umbrella project for deploying a ready-to-us…9.8
- CVE-2026-3277The OpenID Connect (OIDC) authentication configuration in Po…6.5
- CVE-2026-32770Parse Server is an open source backend that can be deployed …7.5
- CVE-2026-32771The CTFer.io Monitoring component is in charge of the collec…9.8
- CVE-2026-32772telnet in GNU inetutils through 2.7 allows servers to read a…4.7
- CVE-2026-32774Vulnogram 1.0.0 contains a stored cross-site scripting vulne…5.4
- CVE-2026-32775libexif through 0.6.25 has a flaw in decoding MakerNotes. If…7.8
- CVE-2026-32776libexpat before 2.7.5 allows a NULL pointer dereference with…5.5
- CVE-2026-32777libexpat before 2.7.5 allows an infinite loop while parsing …5.5
- CVE-2026-32778libexpat before 2.7.5 allows a NULL pointer dereference in t…5.5
- CVE-2026-3278Improper neutralization of input during web page generation …6.1
Are you affected by CVE-2026-32773?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST