Medium severity · published Feb 4, 2019
CVE-2018-11760
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application
5.5
CVSS
0.6%
EPSS
No
On KEV
Description
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apache Spark · Apache Software Foundation
Apache Spark 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1 · source: vendor
SP
Spark · Apache
1.0.2 through 1.6.3; 2.0.0 through 2.0.2; 2.1.0 through 2.1.3; 2.2.0 through 2.2.2; 2.3.0 through 2.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11760
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11760
Third Party Advisory
http://www.securityfocus.com/bid/106786
lists.apache.org
https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e%40%3Ccommits.spark.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b%40%3Cuser.spark.apache.org%3E
More from Apache Spark
8.8
CVE-2022-33891
Apache Spark shell command injection vulnerability via Spark UI
8.8
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerability
6.5
CVE-2025-55039
Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks
6.1
CVE-2026-32773
Apache Spark: XSS Vulnerability in Spark Web 3.5.4
5.9
CVE-2024-23945
Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails