CVE-2026-53421: Apache Syncope: Remote Code Execution via Scripted Connector
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53421?
CVE-2026-53421 has a risk score of 30, indicating a significant threat level.
How do I fix CVE-2026-53421?
To fix CVE-2026-53421, ensure that proper access controls are enforced on the scripted connectors to prevent unauthorized execution.
What systems are affected by CVE-2026-53421?
CVE-2026-53421 affects Apache Syncope installations that utilize scripted connectors with Groovy scripts.
Who can exploit CVE-2026-53421?
An administrator with adequate entitlements can exploit CVE-2026-53421 by using the scripted connector subsystem.
What type of vulnerability is CVE-2026-53421?
CVE-2026-53421 is classified as an Improper Isolation or Compartmentalization vulnerability, allowing for remote code execution.