EUVD-2026-57918
GHSA-pwr8-4vxm-3h37
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable REST API with no complexity; PR:H confirmed by description requiring privileged API user; full RCE yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig.
This issue affects Apache Shindig: all versions.
Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Articles & Coverage 1
AnalysisAI
Remote code execution in Apache Shindig (all versions) is reachable via the project's REST API, where deserialization of attacker-controlled input allows server-side arbitrary code execution. The vulnerability requires high-privilege API access (CVSS PR:H), limiting opportunistic exploitation, but every deployed instance is permanently exposed because the Apache Software Foundation has retired the project and will not release a fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network access to the Apache Shindig REST API endpoint, and (2) valid high-privilege credentials for that API (CVSS PR:H confirms authenticated access is required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network-accessible exploitation with no special complexity, but gated behind high-privilege credentials - the single most significant limiting factor for real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained high-privilege Shindig REST API credentials - through credential theft, phishing, or internal access - crafts a malicious serialized Java object payload and submits it to the REST API endpoint. The server deserializes the payload without validation, triggering a known Java deserialization gadget chain that executes arbitrary OS commands under the process account running Shindig. … |
| Remediation | No vendor-released patch is available and none is planned - the Apache Software Foundation has explicitly stated it will not fix this issue due to project retirement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems running Apache Shindig to determine active usage and criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today