Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache Hive, NiFi, Elasticsearch, Hazelcast, Kogito allow code execution

published 1 month ago
Summary

Several open‑source components used in data processing and messaging can be persuaded to run unwanted code if they are not updated. This risk is fixed in newer versions of each product, so updating to the latest release removes the threat. Make sure the listed packages are upgraded as soon as possible.

What to do
  • Update cleanstart apache-hive to version 4.2.0-r5.
  • Update cleanstart apache-nifi to version 2.9.0-r1.
  • Update cleanstart elasticsearch to version 9.2.7-r0.
  • Update cleanstart elasticsearch to version 9.2.8-r0.
  • Update cleanstart elasticsearch to version 9.3.5-r2.
  • Update cleanstart elasticsearch to version 9.3.7-r0.
  • Update cleanstart elasticsearch to version 9.4.3-r0.
  • Update cleanstart hazelcast to version 5.7.0-r1.
  • Update cleanstart incubator-kie-kogito-data-index-ephemeral to version 10.1.0-r2.
  • Update cleanstart kafka-ui to version 1.4.2-r6.
  • Update cleanstart keycloak to version 26.3.5-r3.
  • Update cleanstart keycloak to version 26.4.2-r0.
  • Update cleanstart keycloak to version 26.4.7-r3.
  • Update cleanstart keycloak to version 26.5.7-r1.
  • Update cleanstart keycloak to version 26.6.3-r2.
  • Update cleanstart s3proxy to version 3.3.0-r1.
  • Update cleanstart thingsboard to version 4.2.2.3-r1.
  • Update cleanstart thingsboard to version 4.3.1.3-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart apache-hive < 4.2.0-r5
Fix: upgrade to 4.2.0-r5
CleanStart cleanstart apache-nifi < 2.9.0-r1
Fix: upgrade to 2.9.0-r1
CleanStart cleanstart elasticsearch < 9.2.7-r0
< 9.2.8-r0
< 9.3.5-r2
< 9.3.7-r0
< 9.4.3-r0
Fix: upgrade to 9.2.7-r0
CleanStart cleanstart hazelcast < 5.7.0-r1
Fix: upgrade to 5.7.0-r1
CleanStart cleanstart incubator-kie-kogito-data-index-ephemeral < 10.1.0-r2
Fix: upgrade to 10.1.0-r2
CleanStart cleanstart kafka-ui < 1.4.2-r6
Fix: upgrade to 1.4.2-r6
CleanStart cleanstart keycloak < 26.3.5-r3
< 26.4.2-r0
< 26.4.7-r3
< 26.5.7-r1
< 26.6.3-r2
Fix: upgrade to 26.3.5-r3
CleanStart cleanstart s3proxy < 3.3.0-r1
Fix: upgrade to 3.3.0-r1
CleanStart cleanstart thingsboard < 4.2.2.3-r1
< 4.3.1.3-r1
Fix: upgrade to 4.2.2.3-r1
Original advisory text
Security fix for CVE-2026-45674 applied in: apache-hive 4.2.0-r5, apache-nifi 2.9.0-r1, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.5-r2, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, keycloak 26.6.3-r2, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1
CVE-2026-45674 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-CD10863 · OSV
Track software like this
Free during beta