Description:
Missing Authorization in Apache Atlas.
A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations.
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.5.0.
Mitigation:
Users are recommended to upgrade to version 2.6.0, which fixes the issue.
CVSS Score
8.8
EPSS Score
0.004
Published
2026-07-29
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVSS Score
5.4
EPSS Score
0.005
Published
2026-06-22
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVSS Score
8.1
EPSS Score
0.005
Published
2026-05-04
Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.
CVSS Score
6.1
EPSS Score
0.026
Published
2020-09-16
Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
CVSS Score
6.1
EPSS Score
0.018
Published
2019-11-18