CVE-2026-32773
Received Received - Intake

Stored XSS in Apache Spark History Server

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Apache Software Foundation

Description
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-32773
EUVD
EUVD-2026-69899

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache spark to 3.5.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in the Spark History Server before version 3.5.8. It occurs because user input is not properly escaped, allowing malicious Spark jobs to inject arbitrary code into web pages. This could lead to minimal privilege escalation in a user's browser.

Detection Guidance

Detection involves checking the Spark History Server version. Run: spark.history.ui.port --version or check the server logs for version information. If the version is below 3.5.8, the system is vulnerable.

Impact Analysis

The impact is limited but requires high permissions to exploit. An attacker needs the ability to launch a Spark job and trick a higher-privileged user into visiting the Spark history web page. The attack could result in minimal browser-based privilege escalation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-severity XSS issue requiring high permissions and user interaction. However, if exploited, it could lead to unauthorized script execution in a user's browser, potentially exposing sensitive data processed by Spark jobs. This may indirectly impact compliance if such data exposure occurs.

Mitigation Strategies

Upgrade the Spark History Server to version 3.5.8 or later immediately. Follow official Apache Spark upgrade instructions to avoid service disruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart