Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

ActiveMQ, Hive, NiFi, Zookeeper may permit unauthorized actions

published 1 month ago
Summary

Several of the messaging and data-management tools you use—ActiveMQ, Apache Hive, Apache NiFi (and its registry), and Apache Zookeeper—have a flaw that could let an attacker cause them to perform actions they shouldn’t. This could lead to data being exposed or altered without permission. Updating each product to the latest released version fixes the problem, so be sure to apply the recommended upgrades as soon as possible.

What to do
  • Update cleanstart activemq to version 6.1.8-r1.
  • Update cleanstart activemq to version 6.2.8-r2.
  • Update cleanstart activemq to version 6.3.1-r1.
  • Update cleanstart apache-hive to version 4.1.0-r5.
  • Update cleanstart apache-nifi to version 2.10.0-r3.
  • Update cleanstart apache-nifi to version 2.6.0-r3.
  • Update cleanstart apache-nifi-registry to version 2.9.0-r3.
  • Update cleanstart apache-zookeeper to version 3.8.6-r5.
  • Update cleanstart apache-zookeeper to version 3.9.5-r5.
  • Update cleanstart cassandra to version 5.0.8-r1.
  • Update cleanstart cassandra-reaper-fips to version 3.8.0-r9.
  • Update cleanstart cassandra-reaper-fips to version 4.0.2-r3.
  • Update cleanstart cassandra-reaper-fips to version 4.1.1-r2.
  • Update cleanstart cassandra-reaper-fips to version 4.2.5-r1.
  • Update cleanstart elasticsearch to version 9.2.8-r1.
  • Update cleanstart elasticsearch to version 9.3.5-r2.
  • Update cleanstart elasticsearch to version 9.4.4-r4.
  • Update cleanstart gradle to version 9.7.1-r0.
  • Update cleanstart hazelcast to version 5.7.0-r1.
  • Update cleanstart kafka to version 4.3.1-r1.
  • Update cleanstart keycloak to version 26.4.13-r1.
  • Update cleanstart keycloak to version 26.4.7-r4.
  • Update cleanstart keycloak to version 26.5.7-r5.
  • Update cleanstart keycloak to version 26.6.3-r3.
  • Update cleanstart keycloak to version 26.6.4-r1.
  • Update cleanstart keycloak to version 26.7.0-r1.
  • Update cleanstart kserve-modelmesh to version 0.12.0-r17.
  • Update cleanstart logstash-fips to version 9.4.3-r1.
  • Update cleanstart rundeck to version 6.0.0-r2.
  • Update cleanstart rundeck to version 6.0.1-r0.
  • Update cleanstart s3proxy to version 3.3.0-r1.
  • Update cleanstart solr to version 10.0.0-r5.
  • Update cleanstart solr to version 9.10.1-r7.
  • Update cleanstart solr to version 9.8.1-r1.
  • Update cleanstart sonarqube to version 26.3.0.120487-r4.
  • Update cleanstart spark to version 3.5.9-r1.
  • Update cleanstart spark-sc212-jdk17-py311 to version 3.4.4-r0.
  • Update cleanstart spark-sc213-jdk17-py312 to version 3.4.4-r1.
  • Update cleanstart spark-sc213-jdk17-py312 to version 3.5.8-r0.
  • Update cleanstart spark-sc213-jdk17-py312 to version 4.0.3-r0.
  • Update cleanstart spark-sc213-jdk17-py312 to version 4.1.2-r0.
  • Update cleanstart strimzi-kafka-operator to version 1.1.0-r1.
  • Update cleanstart thingsboard to version 4.2.2.3-r1.
  • Update cleanstart thingsboard to version 4.3.1.3-r1.
  • Update cleanstart trino to version 480-r7.
  • Update cleanstart wso2is to version 7.0.0-r1.
  • Update cleanstart wso2is to version 7.1.0-r1.
  • Update cleanstart wso2is to version 7.2.0-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart activemq < 6.1.8-r1
< 6.2.8-r2
< 6.3.1-r1
Fix: upgrade to 6.1.8-r1
CleanStart cleanstart apache-hive < 4.1.0-r5
Fix: upgrade to 4.1.0-r5
CleanStart cleanstart apache-nifi < 2.10.0-r3
< 2.6.0-r3
Fix: upgrade to 2.10.0-r3
CleanStart cleanstart apache-nifi-registry < 2.9.0-r3
Fix: upgrade to 2.9.0-r3
CleanStart cleanstart apache-zookeeper < 3.8.6-r5
< 3.9.5-r5
Fix: upgrade to 3.8.6-r5
CleanStart cleanstart cassandra < 5.0.8-r1
Fix: upgrade to 5.0.8-r1
CleanStart cleanstart cassandra-reaper-fips < 3.8.0-r9
< 4.0.2-r3
< 4.1.1-r2
< 4.2.5-r1
Fix: upgrade to 3.8.0-r9
CleanStart cleanstart elasticsearch < 9.2.8-r1
< 9.3.5-r2
< 9.4.4-r4
Fix: upgrade to 9.2.8-r1
CleanStart cleanstart gradle < 9.7.1-r0
Fix: upgrade to 9.7.1-r0
CleanStart cleanstart hazelcast < 5.7.0-r1
Fix: upgrade to 5.7.0-r1
CleanStart cleanstart kafka < 4.3.1-r1
Fix: upgrade to 4.3.1-r1
CleanStart cleanstart keycloak < 26.4.13-r1
< 26.4.7-r4
< 26.5.7-r5
< 26.6.3-r3
< 26.6.4-r1
< 26.7.0-r1
Fix: upgrade to 26.4.13-r1
CleanStart cleanstart kserve-modelmesh < 0.12.0-r17
Fix: upgrade to 0.12.0-r17
CleanStart cleanstart logstash-fips < 9.4.3-r1
Fix: upgrade to 9.4.3-r1
CleanStart cleanstart rundeck < 6.0.0-r2
< 6.0.1-r0
Fix: upgrade to 6.0.0-r2
CleanStart cleanstart s3proxy < 3.3.0-r1
Fix: upgrade to 3.3.0-r1
CleanStart cleanstart solr < 10.0.0-r5
< 9.10.1-r7
< 9.8.1-r1
Fix: upgrade to 10.0.0-r5
CleanStart cleanstart sonarqube < 26.3.0.120487-r4
Fix: upgrade to 26.3.0.120487-r4
CleanStart cleanstart spark < 3.5.9-r1
Fix: upgrade to 3.5.9-r1
CleanStart cleanstart spark-sc212-jdk17-py311 < 3.4.4-r0
Fix: upgrade to 3.4.4-r0
CleanStart cleanstart spark-sc213-jdk17-py312 < 3.4.4-r1
< 3.5.8-r0
< 4.0.3-r0
< 4.1.2-r0
Fix: upgrade to 3.4.4-r1
CleanStart cleanstart strimzi-kafka-operator < 1.1.0-r1
Fix: upgrade to 1.1.0-r1
CleanStart cleanstart thingsboard < 4.2.2.3-r1
< 4.3.1.3-r1
Fix: upgrade to 4.2.2.3-r1
CleanStart cleanstart trino < 480-r7
Fix: upgrade to 480-r7
CleanStart cleanstart wso2is < 7.0.0-r1
< 7.1.0-r1
< 7.2.0-r1
Fix: upgrade to 7.0.0-r1
Original advisory text
Security fix for CVE-2026-54515 applied in: activemq 6.1.8-r1, activemq 6.2.8-r2, activemq 6.3.1-r1, apache-hive 4.1.0-r5, apache-nifi 2.10.0-r3, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, apache-zookeeper 3.8.6-r5, apache-zookeeper 3.9.5-r5, cassandra 5.0.8-r1, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r2, cassandra-reaper-fips 4.2.5-r1, elasticsearch 9.2.8-r1, elasticsearch 9.3.5-r2, elasticsearch 9.4.4-r4, gradle 9.7.1-r0, hazelcast 5.7.0-r1, kafka 4.3.1-r1, keycloak 26.4.13-r1, keycloak 26.4.7-r4, keycloak 26.5.7-r5, keycloak 26.6.3-r3, keycloak 26.6.4-r1, keycloak 26.7.0-r1, kserve-modelmesh 0.12.0-r17, logstash-fips 9.4.3-r1, rundeck 6.0.0-r2, rundeck 6.0.1-r0, s3proxy 3.3.0-r1, solr 10.0.0-r5, solr 9.10.1-r7, solr 9.8.1-r1, sonarqube 26.3.0.120487-r4, spark 3.5.9-r1, spark-sc212-jdk17-py311 3.4.4-r0, spark-sc213-jdk17-py312 3.4.4-r1, spark-sc213-jdk17-py312 3.5.8-r0, spark-sc213-jdk17-py312 4.0.3-r0, spark-sc213-jdk17-py312 4.1.2-r0, strimzi-kafka-operator 1.1.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r7, wso2is 7.0.0-r1, wso2is 7.1.0-r1, wso2is 7.2.0-r1
CVE-2026-54515 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-OP16049 · OSV
Track software like this
Free during beta