Cross-Site Scripting Vulnerability in Spark History Server by Apache

CVE-2026-32773

What is CVE-2026-32773?

A Cross-Site Scripting (XSS) vulnerability exists in the Apache Spark History Server versions before 3.5.8. This vulnerability allows a malicious Spark job to execute arbitrary unescaped frontend code. As a result, it can lead to potential privilege escalation when users with higher permissions inadvertently access the infected Spark history web page. It is essential for users to upgrade to Spark 3.5.8 or later to mitigate the risks associated with this vulnerability.

References