Remote Code Execution Vulnerability in Apache HugeGraph PD Store

CVE-2025-26866

What is CVE-2025-26866?

A vulnerability exists within the PD store of Apache HugeGraph that allows remote code execution via insecure Hessian deserialization. A malicious Raft node can exploit this flaw, potentially compromising the integrity of the system. The recommended remedy includes upgrading to version 1.7.0, where IP-based authentication is enforced to limit cluster membership and a strict class whitelist is implemented to safeguard against object injection attacks. This patch enhances overall security and mitigates risks associated with this vulnerability.

References