CVE-2025-54947

Severity
9.8CRITICAL
EPSS
0.0%
top 86.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 12

Description

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access. This issu

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

NVDapache/streampark2.0.02.1.7
Mavenorg.apache.streampark:streampark2.0.02.1.7

🔴Vulnerability Details

3
OSV
Apache StreamPark has a hard-coded encryption key2025-12-12
CVEList
Apache StreamPark: Use hard-coded key vulnerability2025-12-12
GHSA
Apache StreamPark has a hard-coded encryption key2025-12-12

🕵️Threat Intelligence

1
Wiz
CVE-2025-54947 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2025-54947 (CRITICAL CVSS 9.8) | In Apache StreamPark versions 2.0.0 | cvebase.io