Apache HugeGraph-Server: Bypass whitelist in Auth mode

CRITICAL 9.1CVE-2024-27349 · GHSA-6mgp-p75r-vhjm · Published 22/04/2024 · updated 17/06/2026

In short

CVE-2024-27349 is a CRITICAL (CVSS 9.1) vulnerability affecting org.apache.hugegraph:hugegraph-api, hugegraph (apache).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.5% of all vulnerabilities.
Fix: update to 1.3.0 or later.

Package	Affected versions	Patched versions
org.apache.hugegraph:hugegraph-api Maven	`≥ 1.0.0, < 1.3.0`	`1.3.0`
hugegraph apache	`≥ 1.0.0, < 1.3.0`	`1.3.0`

Description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-27349 · ADVISORY
apache/incubator-hugegraph commit 713d88d · WEB
apache/incubator-hugegraph · PACKAGE
lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd · WEB
openwall.com/lists/oss-security/2024/04/22/4 · WEB

More vulnerabilities in org.apache.hugegraph:hugegraph-api

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.hugegraph:hugegraph-api

Maven

≥ 1.0.0, < 1.3.0

1.3.0

hugegraph

apache

≥ 1.0.0, < 1.3.0

1.3.0

Description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description