CVE-2026-32773: Apache Spark: XSS Vulnerability in Spark Web 3.5.4
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Spark (Spark History Server)to a version that resolves this vulnerability.Fixed in 3.5.8
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Spark History Server deployments running a version before 3.5.8 are affected. Exploitation requires a user who can launch a malicious Spark job and a higher-privileged user who later logs in and visits the Spark history web page.
What access does an attacker need?
The attacker needs relatively high permissions: the ability to launch a Spark job that can generate unescaped frontend code in the History Server. They must also persuade or otherwise cause a higher-privileged user to view the relevant history page.
What should be done if the History Server cannot be upgraded immediately?
The provided information recommends upgrading Spark History Server to 3.5.8 or later and does not specify an alternative mitigation. Until upgraded, limiting who can launch Spark jobs and reducing higher-privileged users' exposure to History Server pages would address the stated exploitation prerequisites.