Bug 2527318 (CVE-2026-32773) - CVE-2026-32773 Apache Spark: Apache Spark: Cross-Site Scripting (XSS) leading to privilege escalation
Summary: CVE-2026-32773 Apache Spark: Apache Spark: Cross-Site Scripting (XSS) leading...
Keywords:
Status: NEW
Alias: CVE-2026-32773
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-02 11:04 UTC by OSIDB Bzimport
Modified: 2026-10-06 17:34 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-02 11:04:55 UTC 
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Note You need to log in before you can comment on or make changes to this bug.