Sign in
Deutsch English Español Polski
Medium

Pyspark User Impersonation Vulnerability

  • Disclosed: 04.02.2019
  • Updated: 11.10.2026 12:18

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) pyspark >= 2.3.0, < 2.3.2, >= 1.0.2, < 2.2.3 2.3.2, 2.2.3

References

CVSS score 5.5/10
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE)
-
Platform
Python (PyPI)
Package
pyspark
Disclosed
04.02.2019
Updated
11.10.2026 12:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2019-169 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-fvxv-9xxr-h7wj - CC BY 4.0

Vulnerability history: pyspark

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive
Total entries
12
First → latest
09.2017 09.2026
Without a fix
0
Exploited in attacks
1

Severity breakdown

  • Critical 2
  • High 5
  • Medium 5

Disclosures per year

Severity:
  1. ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has
    High · 8.8 CVE-2023-32007 < 3.2.2 3.2.2
  2. In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitti
    Critical · 9.9 CVE-2023-22946 < 3.4.0 3.4.0
  3. Apache Spark UI can allow impersonation if ACLs enabled
    High · 8.8 Exploited in attacks CVE-2022-33891 < 3.1.3, >= 3.2.0, < 3.2.2 3.1.3, 3.2.2
  4. Authentication Bypass by Capture-replay in Apache Spark
    High · 7.5 CVE-2021-38296 < 3.1.3 3.1.3
  5. In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-craft
    Critical · 9.8 CVE-2020-9480 < 2.4.6 2.4.6
  6. Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (contr
    High · 7.5 CVE-2019-10099 < 2.3.3 2.3.3
  7. Pyspark User Impersonation Vulnerability this entry
    Medium · 5.5 CVE-2018-11760 >= 2.3.0, < 2.3.2, >= 1.0.2, < 2.2.3 2.3.2, 2.2.3
  8. Apache Spark Deserialization of Untrusted Data vulnerability
    High · 7.8 CVE-2017-12612 < 2.1.2 2.1.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.