CVE-2020-9480Spark Authentication Bypass
Improper Authentication in Apache Spark
Published Feb 10, 2022 · Updated Oct 20, 2026 · Also known as BIT-spark-2020-9480, GHSA-wgx7-jwwm-cgjv, PYSEC-2020-95
Key Facts
Patch immediately- CVE-2020-9480 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Spark (Apache), Business Intelligence (Oracle), org.apache.spark:spark-parent_2.11 (pypi) and 1 more product.
- It is exploited in the wild, listed in Industry KEV feed since May 10, 2024. No public exploit code is known.
- EPSS estimates a 29% probability of exploitation in the next 30 days.
- Fixed versions are available, including Spark <=2.4.5, Spark 2.4.6, org.apache.spark:spark-parent_2.11 2.4.6.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v4
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
29%
Higher than 98.1% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
May 10, 2024
820 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
2
Reports of active use
Advisories And Exploit References
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2020-9480
- advisoryGHSA advisory
- advisoryhttps://www.oracle.com/security-alerts/cpuapr2021.html
- advisoryUSOM advisory
Description
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key.
This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | May 10, 2024 | n/a | Not reported |
Affected Products
6 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SparkApache | >= Apache Spark 2.4.5 and earlier | 2.4.5 |
| Business IntelligenceOracle | 5.5.0.0.0 | n/a |
| org.apache.spark:spark-parent_2.11pypi | See advisory | 2.4.6 |
| pysparkpypi | See advisory | 2.4.6 |
Patched Releases
Spark
<=2.4.5, 2.4.6
org.apache.spark:spark-parent_2.11
2.4.6
pyspark
2.4.6
Timeline
Publicly disclosed
Feb 10, 2022
Added to Industry KEV feed
May 10, 2024
Last updated
Oct 20, 2026
Weakness Type
- CWE-287 Improper Authentication
- CWE-306 Missing Authentication for Critical Function
References
- advisorynvd.nist.gov · CVE-2020-9480
- advisoryGHSA advisory
- advisoryoracle.com · cpuapr2021.html
- advisoryUSOM advisory
- exploitVulnCheck exploitation report
FAQ
Common Questions.
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret.
Affected: Spark (Apache) versions >= Apache Spark 2.4.5 and earlier; Business Intelligence (Oracle) versions 5.5.0.0.0; org.apache.spark:spark-parent_2.11 (pypi), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since May 10, 2024.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Spark <=2.4.5, Spark 2.4.6, org.apache.spark:spark-parent_2.11 2.4.6.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2020-9480 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo