UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentica…

Critical CVSS 9.8

CVECVE-2024-36265

First seen2026-07-14 17:21 UTC

Disclosed2024-06-12 15:15 UTC

Last updated2026-07-14 17:21 UTC

Channel statusauto

Summary

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longe…

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://lists.apache.org/thread/prckhhst19qxof064hsm8cccxtofvflz Mailing List
http://www.openwall.com/lists/oss-security/2024/06/12/3 Mailing List
https://lists.apache.org/thread/prckhhst19qxof064hsm8cccxtofvflz Mailing List

Timeline

2026-07-14 nvd_ingest NVD