https://seclists.org/oss-sec/2026/q3/635: CVE-2026-32773: Apache Spark: XSS Vulnerability in Spark Web 3.5.4

Q: Who is realistically exposed to this issue?

Spark History Server deployments running Apache Spark versions 3.0.0 before 3.5.8 are affected. Exploitation requires a user who can launch a malicious Spark job and a higher-privileged user who later logs in and visits the relevant history page.

Q: Is a default History Server deployment exploitable by an unauthenticated remote attacker?

The reported exploit path does not describe unauthenticated exploitation. It requires relatively high permissions to launch a Spark job, plus social engineering or another mechanism to cause a higher-privileged user to visit the Spark history web page.

Q: What should be done if the History Server cannot be upgraded immediately?

The advisory only provides upgrading to Spark 3.5.8 or later as remediation. Until then, reduce the ability of untrusted users to launch Spark jobs and limit higher-privileged users' exposure to Spark History Server pages generated from untrusted jobs.

Published Sep 1, 2026

Updated

Affected Software

1 affected component

Apache Spark>=3.0.0<3.5.8

Frequently Asked Questions

Who is realistically exposed to this issue?

Spark History Server deployments running Apache Spark versions 3.0.0 before 3.5.8 are affected. Exploitation requires a user who can launch a malicious Spark job and a higher-privileged user who later logs in and visits the relevant history page.

Is a default History Server deployment exploitable by an unauthenticated remote attacker?

The reported exploit path does not describe unauthenticated exploitation. It requires relatively high permissions to launch a Spark job, plus social engineering or another mechanism to cause a higher-privileged user to visit the Spark history web page.

What should be done if the History Server cannot be upgraded immediately?

The advisory only provides upgrading to Spark 3.5.8 or later as remediation. Until then, reduce the ability of untrusted users to launch Spark jobs and limit higher-privileged users' exposure to Spark History Server pages generated from untrusted jobs.