Apache Projects Hit by 24 Vulnerabilities, Including Critical Code Execution Flaws
A batch of 24 vulnerabilities, including critical flaws in Camel K and Artemis, were disclosed across multiple Apache projects from September 7-11, 2026.
Key findings
- 24 CVEs disclosed together for Apache projects between Sep 7-11, 2026, ranging from Medium to Critical severity.
- Critical vulnerabilities (CVSS 9.8) in Apache Camel K allow code injection and unauthorized resource creation.
- Multiple critical flaws in Apache Artemis and ActiveMQ Artemis enable session hijacking, queue deletion, and credential theft.
- Apache Impala affected by critical user impersonation (CVE-2026-56207) and SSRF vulnerabilities.
- Apache Nutch Server has critical vulnerabilities; upgrade to 1.23 or remove the server is recommended.
- Broad impact across OpenNLP, FreeMarker, Parquet, Ant, and Airflow necessitates prompt patching.
On September 11, 2026, a batch of 24 vulnerabilities affecting various Apache Software Foundation products was disclosed, spanning a disclosure window from September 7th to September 11th. The vulnerabilities range in severity from Medium to Critical, with several critical flaws carrying CVSS scores of 9.8. These issues impact a wide array of Apache projects including OpenNLP, Camel K, FreeMarker, Artemis, ActiveMQ, Impala, Parquet, Nutch, Airflow, and Ant, highlighting a broad security concern across the Apache ecosystem.
Several critical vulnerabilities were identified in Apache Camel K, a Kubernetes-native integration framework. CVE-2026-80352, a Code Injection flaw with a CVSS score of 9.8, allows an authorized CR author to inject arbitrary Kubernetes objects by exploiting a YAML injection vulnerability in custom resource configuration. This could lead to unauthorized resource creation with the privileges of the operator. Similarly, CVE-2026-80351, an eval injection vulnerability (CVSS 9.8), enables tenant-controlled repository content to influence code execution within the operator pod through improper neutralization of directives in dynamically evaluated Maven configuration. Another critical issue, CVE-2026-80354 (CVSS 8.1), is an authorization bypass through a User-Controlled key vulnerability, allowing a tenant to reference secrets by name in the operator namespace, potentially exposing sensitive information.
Apache Artemis and ActiveMQ Artemis message brokers were also affected by multiple critical vulnerabilities. CVE-2026-57967 (CVSS 9.8) allows an unauthenticated remote attacker to steal an existing session and assume ongoing execution by crafting a CORE protocol SESSION_REATTACH packet. CVE-2026-67593 (CVSS 9.1) enables a remote attacker to delete queues on the Artemis broker by crafting an Openwire RemoveSubscriptionInfo command, bypassing authentication and authorization stages. CVE-2026-49364 (CVSS 9.1) permits an unauthenticated network-adjacent attacker to capture cluster administrative credentials during the initial cluster connection handshake via discovery. Additionally, CVE-2026-49362 (CVSS 7.5) allows an unauthenticated remote attacker to create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. CVE-2026-75880 (CVSS 6.5) involves an authenticated client crafting a consumer selector with wildcards to cause excessive evaluation, leading to a denial of service. CVE-2026-57822 (CVSS 6.5) involves Java deserialization of certain method parameters during message-based management requests, though the broker will not utilize them. CVE-2026-49363 (CVSS 7.5) allows an unauthenticated remote attacker to discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. CVE-2026-74761 (CVSS 7.5) in Apache ActiveMQ Broker allows an authenticated client to spoof clientId when removing a durable topic subscription.
Apache Impala faced several high and critical vulnerabilities. CVE-2026-56207 (CVSS 9.8) allows an attacker to alter usernames and act as another user by not verifying the signature of a Bearer token in the final step of SAML2 authentication for Impala's hs2-http interface. CVE-2026-84939 (CVSS 9.1) is a path traversal vulnerability in Apache FreeMarker's template loading mechanism, exploitable if an attacker specifies a malformed locale identifier and localized lookup is enabled. CVE-2026-73334 (CVSS 8.1) in Apache Parquet's org.apache.parquet.crypto.keytools package could pose a problem for users encrypting Parquet files, as the KMS URL can be exposed. CVE-2026-65181 (CVSS 8.1) in Impala allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code due to insufficient authorization of Data Source tables. CVE-2026-57866 (CVSS 8.8) is a server-side request forgery vulnerability in Impala, allowing authenticated users with ai_generate_text() permissions to exfiltrate secrets from credential providers. CVE-2026-54048 (CVSS 5.3) allows an attacker to trigger GET requests to internal endpoints by specifying avro.schema.url with a remote or file URI on a table.
Apache Nutch Server (Nutch REST API) is affected by critical and high-severity vulnerabilities. CVE-2026-41871 (CVSS 9.8) involves Missing Authorization and Unsafe Reflection, allowing code execution. CVE-2026-41870 (CVSS 8.8) combines Missing Authorization, Code Injection, and Unsafe Reflection. CVE-2026-41869 (CVSS 9.1) includes Missing Authorization and Improper Resource Shutdown. Apache recommends upgrading to version 1.23, which removes the Nutch Server, or restricting access if an upgrade is not possible.
Other affected Apache projects include OpenNLP, with CVE-2026-82617 (Critical) involving ambiguous nested quantifiers in name-finder patterns, and CVE-2026-67211 (Critical) for an Out-of-Memory Denial of Service via Unbounded Map Pre-Sizing in SymSpellModelSerializer. Apache Airflow's FAB provider is affected by CVE-2026-75156 (Critical), where versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD id_tokens during OAuth login when the FAB auth manager is configured with Azure AD. Finally, CVE-2026-78254 (High, CVSS 7.4) in Apache Ant allows a malicious server to overwrite files outside the target directory using relative paths in its ftp and scp tasks.
The wide range of affected products and the presence of critical vulnerabilities underscore the importance of prompt patching and security reviews for all Apache users. The disclosure highlights potential risks across various Apache components, from integration frameworks and message brokers to data processing and build tools. Users are strongly advised to consult the specific advisories for each affected product and apply the recommended updates or mitigations immediately.
The batch of vulnerabilities was disclosed between September 7 and September 11, 2026. The critical CVE-2026-80352 and CVE-2026-80351 in Apache Camel K, and CVE-2026-57967 in Apache Artemis, all carry a CVSS score of 9.8, indicating a severe risk. Apache Impala versions 4.0.0 and above are affected by CVE-2026-56207, which allows for user impersonation. Apache Nutch versions 1.10 through 1.22 are affected by CVE-2026-41871, CVE-2026-41870, and CVE-2026-41869, with a recommendation to upgrade to version 1.23 or remove the Nutch Server. Apache Artemis versions 2.50.0 through 2.56.0 and ActiveMQ Artemis versions 1.0.0 through 2.44.0 are affected by multiple critical flaws including CVE-2026-57967, CVE-2026-67593, and CVE-2026-49364. Apache FreeMarker versions 2.2.0 through 2.3.34 are affected by CVE-2026-84939. Apache Parquet versions 1.12 to 1.18 are affected by CVE-2026-73334. Apache Impala versions 2.7-4.5 are affected by CVE-2026-65181 and versions 4.4.x and 4.5.x by CVE-2026-57866. Apache Impala versions 2.0.0 to 4.5.1 are affected by CVE-2026-54048. Apache Ant tasks are affected by CVE-2026-78254. Apache Airflow FAB provider versions 3.7.3 through 3.8.0 are affected by CVE-2026-75156. Apache OpenNLP versions affected by CVE-2026-82617 and CVE-2026-67211 are not explicitly stated but are related to RegexNameFinderFactory and SymSpellModelSerializer.
The broad impact of this batch of vulnerabilities across numerous Apache projects necessitates immediate attention from system administrators and security professionals managing Apache-based infrastructure. The critical nature of several flaws, particularly those allowing code injection, authorization bypass, and session hijacking, poses a significant risk to data confidentiality, integrity, and system availability. Users should prioritize applying patches and implementing recommended mitigations to protect their environments.
The vulnerabilities disclosed between September 7 and September 11, 2026, represent a significant security event for the Apache ecosystem. The critical severity of several flaws, including code injection in Camel K (CVE-2026-80352, CVE-2026-80351) and session hijacking in Artemis (CVE-2026-57967), demands urgent action. Users of Apache Impala should be particularly aware of CVE-2026-56207, which permits user impersonation. For Apache Nutch, the recommendation to upgrade to version 1.23 or remove the Nutch Server is critical due to vulnerabilities CVE-2026-41871, CVE-2026-41870, and CVE-2026-41869. System administrators are urged to review the specific CVE details and apply the necessary updates or workarounds to secure their deployments. The wide scope of affected projects underscores the need for continuous vigilance and proactive security management within the Apache user community.