What is CVE-2025-47411?

CVE-2025-47411 is a high-severity vulnerability in Apache Streampipes, classified under Improper Privilege Management. CVSS score: 8.1/10. Published 2026-01-01.

How severe is CVE-2025-47411?

High severity. CVSS v3 base score is 8.1 out of 10.

Privilege escalation in Apache Streampipes

CVE-2025-47411

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.

Vulnerability class: Privilege Escalation

EPSS: 0.148 (96.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Apache Streampipes
Apache Software Foundation Streampipes — versions 0.69.0

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2025-47411?: CVE-2025-47411 is a high-severity vulnerability in Apache Streampipes, classified under Improper Privilege Management. CVSS score: 8.1/10. Published 2026-01-01.
How severe is CVE-2025-47411?: High severity. CVSS v3 base score is 8.1 out of 10.