Critical privilege escalation flaw in Apache StreamPipes allows admin takeover

Summary

Apache StreamPipes fixed a critical privilege escalation vulnerability (CVE-2025-47411) that allows non-admin users to hijack administrator accounts through JWT manipulation. Attackers can exploit this flaw to gain full system control, tamper with data, and compromise streaming infrastructure.

Take Action:

If you are using Apache StreamPipes, this is important. First, make sure it's isolated from the internet and accessible from trusted networks and users only. Then plan a very quick update, because the exploit is just changing a value in the JWT token.

---

Read the full article on BeyondMachines

---

This article was originally published on BeyondMachines