CVE-2026-32773

mediumpriority · track · 0EPSS 0.004 · 36 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (36th) EPSS

CVSS 6.1 · medium

Is it mine?

5 products

Check your exposure

Who says so?

2 sources

osv · nvd

EPSS · scored 2026-10-27

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondaryexploitability 2.8 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-80USCWE-80US

affected products (5)

Products and version ranges known to be affected.

apache spark3.0.0 → 3.5.8nvdUScpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
Bitnami spark3.0.0 → 3.5.8osvUSpkg:bitnami/spark
Maven org.apache.spark:spark-core_2.123.0.0 → 3.5.8osvUSpkg:maven/org.apache.spark/spark-core_2.12
Maven org.apache.spark:spark-core_2.133.0.0 → 3.5.8osvUSpkg:maven/org.apache.spark/spark-core_2.13
PyPI pyspark3.0.0 → 3.5.8osvUSpkg:pypi/pyspark

advisories (3)

Vendor and ecosystem advisories describing this.

GHSA-9437-39hj-3c93Apache Spark History Server allows stored cross-site scripting through unescaped application names2026-09-02ghsa · osvUS
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
BIT-spark-2026-32773Apache Spark: XSS Vulnerability in Spark Web 3.5.42026-09-08vendor · osvUS
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
PYSEC-2026-39662026-09-02vendor · osvUS
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

osv nvd NVD CVE.org MITRE

published 2026-09-02modified 2026-09-03

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan