CVE-2025-26866: Apache HugeGraph-Server: RAFT and deserialization vulnerability

December 12, 2025

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.

Users are recommended to upgrade to version 1.7.0, which fixes the issue.

References

github.com/advisories/GHSA-q37j-3367-fwv7
github.com/apache/incubator-hugegraph
github.com/apache/incubator-hugegraph/pull/2735
lists.apache.org/thread/ko8jkwbjbb99m45pg4sgo5xsm8gx9nsq
nvd.nist.gov/vuln/detail/CVE-2025-26866

Code Behaviors & Features

Detect and mitigate CVE-2025-26866 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →