CVE-2024-36265

Critical · CVSS 9.8

Apache Submarine Server Core — Incorrect Authorization / Authentication Bypass via crafted REST requests

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-863

Description

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Search profile — drives PoC discovery

Symbols submarine-server-coreRESTauthentication bypassSubmarineServersubmarine-serverapache submarine

Keywords CVE-2024-36265Apache Submarineauthentication bypassSubmarine Server CoreCWE-863REST bypassSubmarine 0.8.0incorrect authorization

Versions: 0.8.0 and later

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-14T12:00:20.000Z · profiled 2026-07-14T12:30:20.000Z