Critical privilege escalation flaw in Apache StreamPipes allows admin takeover

Source: Dev.to

Summary

Apache StreamPipes fixed a critical privilege escalation vulnerability (CVE‑2025‑47411) that allows non‑admin users to hijack administrator accounts through JWT manipulation. Attackers can exploit this flaw to gain full system control, tamper with data, and compromise streaming infrastructure.

Take Action

If you are using Apache StreamPipes, this is important:

1. Ensure the system is isolated from the internet and accessible only from trusted networks and users.
2. Plan a rapid update, as the exploit merely involves changing a value in the JWT token.

Read the full article on BeyondMachines

Originally published on BeyondMachines.