Apache Software Foundation Apache Atlas vulnerabilities
12 vulnerabilities
Known vulnerabilities in Apache Software Foundation Apache Atlas, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2016-8752apache software foundationapache atlas+3
EPSS score2.13%
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.CVE-2025-62198apache software foundationapache atlas+2EPSS score0.51%
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.CVE-2022-34271apache software foundationapache atlas+2EPSS score1.48%
A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.CVE-2017-3152apache software foundationapache atlas+3EPSS score2.21%
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.CVE-2017-3151apache software foundationapache atlas+3EPSS score2.17%
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.CVE-2017-3153apache software foundationapache atlas+3EPSS score2.21%
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.CVE-2017-3154apache software foundationapache atlas+3EPSS score2.05%
Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.CVE-2017-3150apache software foundationapache atlas+3EPSS score2.21%
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.CVE-2017-3155apache software foundationapache atlas+3EPSS score2.05%
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.CVE-2024-46910apache software foundationapache atlas+2EPSS score0.57%
An authenticated user can perform XSS and potentially impersonate another user.
This issue affects Apache Atlas versions 2.3.0 and earlier.
Users are recommended to upgrade to version 2.4.0, which fixes the issue.CVE-2026-40563apache software foundationapache atlas+2EPSS score0.60%
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.CVE-2026-50622apache software foundationapache atlas+1EPSS score0.58%
Description:
Missing Authorization in Apache Atlas.
A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations.
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.5.0.
Mitigation:
Users are recommended to upgrade to version 2.6.0, which fixes the issue.