Apache StreamPark CVE-2025-54947

The vulnerability exists in default deployments of Apache StreamPark 2.0.0 through 2.1.6 because the application ships with a fixed, immutable encryption key rather than generating or securely configuring one per-install. No special non-default configuration is required for the weakness to be present. Practical exploitation is LIMITED by the need for the attacker to (1) recover the static key via reverse engineering, code analysis, or inspection of the open-source project, and (2) possess attacker-relevant material to act on - i.e., captured encrypted/sensitive data to decrypt, or the ability to present forged encrypted tokens to the StreamPark instance. There is no user-interaction or authentication requirement to recover the key, but value is only realized against reachable encrypted data or token-validating endpoints.

Signals are mixed and should be read carefully. Apache's official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) yields 9.8 and treats this as a remote, unauthenticated, low-complexity flaw with full C/I/A impact. However, the A:H (availability) rating is questionable for a hard-coded encryption key (CWE-321): the described impact is decryption of sensitive data and forgery of encrypted information, which maps naturally to confidentiality and integrity, not to denial of service - this inflates the headline score. The EPSS score is low (0.48%, 39th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or imminent widespread exploitation. The static key is shared across all installations and recoverable via reverse engineering or source review, which is what justifies the network/unauthenticated framing; but practical exploitation still requires the attacker to possess target ciphertext (to decrypt) or a position to inject forged encrypted tokens (to gain access). Net assessment: a genuinely serious cryptographic weakness worth prioritizing for patching, but the real-world urgency is lower than the 9.8 suggests given low EPSS, no KEV, no known POC, and the practical data-access prerequisites.

An attacker extracts the fixed encryption key from Apache StreamPark's publicly available source code or a deployed binary via reverse engineering. Using that key, the attacker decrypts captured sensitive data (e.g., stored credentials or config secrets) or forges validly-encrypted tokens to impersonate a user or gain unauthorized access to the StreamPark console. No public exploit code was identified at time of analysis, but the key recovery is trivial since it is identical across all 2.0.0-2.1.6 installations.