CVE-2025-68637

Critical

Description

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

SeverityCritical

CVSS9.1

Exploit probability—

Product

Apache Uniffle

PublishedJan 7, 2026

First seenJan 7, 2026

Weakness typeCWE-297CWE-297

How to fix

Update

apache uniffle0.10.0 or later

Vendor advisories

lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v

Affected products

Product	Affected versions	Fixed in
apache uniffle	v < 0.10.0	0.10.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.