CVE-2025-68637: Apache Uniffle Information Disclosure Flaw

CVE-2025-68637 Overview

CVE-2025-68637 is a critical SSL/TLS vulnerability affecting Apache Uniffle, a Remote Shuffle Service for distributed computing frameworks. The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default, creating a significant security gap in the communication layer between the Uniffle CLI/client and the Uniffle Coordinator service.

This insecure configuration exposes all REST API communication to potential Man-in-the-Middle (MITM) attacks, allowing attackers to intercept, modify, or eavesdrop on sensitive data being transmitted between components. The vulnerability is classified under CWE-297 (Improper Validation of Certificate with Host Mismatch).

Critical Impact

All REST API communications between Uniffle CLI/client and Coordinator service are vulnerable to Man-in-the-Middle attacks due to disabled SSL certificate validation and hostname verification.

Affected Products

• Apache Uniffle versions before 0.10.0
• All Uniffle HTTP client implementations in affected versions
• Uniffle CLI/client to Coordinator service communications

Discovery Timeline

• 2026-01-07 - CVE-2025-68637 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-68637

Vulnerability Analysis

This vulnerability represents a fundamental failure in secure communication design. The Uniffle HTTP client bypasses two critical SSL/TLS security mechanisms: certificate validation and hostname verification. When an application trusts all SSL certificates without validation, it accepts any certificate presented by a server, including self-signed or fraudulently obtained certificates. Combined with disabled hostname verification, an attacker can present any valid certificate and the client will accept it, even if it was issued for a completely different domain.

The impact is severe as it compromises the confidentiality and integrity of all data transmitted via the REST API. Attackers positioned on the network path between the client and coordinator can decrypt, read, and modify traffic in transit without detection.

Root Cause

The root cause is an insecure default configuration in the Uniffle HTTP client library. The implementation explicitly disables SSL certificate chain validation and hostname verification, likely implemented during development for testing purposes but inadvertently left enabled in production builds. This configuration accepts any certificate regardless of its validity, chain of trust, or whether it matches the target hostname.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker with network access between the Uniffle client and coordinator service can:

1. Position themselves in the network path (via ARP spoofing, DNS poisoning, or compromised network infrastructure)
2. Present a fraudulent SSL certificate to the Uniffle client
3. Intercept and decrypt all REST API traffic
4. Modify requests and responses in transit
5. Steal sensitive configuration data, credentials, or shuffle data

The attack requires network positioning but does not require any privileges on the target systems. Because no certificate validation occurs, standard certificate-based protections are completely ineffective.

Detection Methods for CVE-2025-68637

Indicators of Compromise

• Unexpected SSL certificates presented during Uniffle client-to-coordinator communications
• Network anomalies indicating traffic interception between Uniffle components
• Suspicious ARP entries or DNS responses in environments running Uniffle services
• Log entries showing successful connections from unexpected IP addresses or network segments

Detection Strategies

• Monitor network traffic for SSL/TLS connections that do not use proper certificate pinning or validation
• Implement network-level intrusion detection to identify potential MITM positioning attacks
• Review Uniffle client logs for connection patterns that may indicate intercepted communications
• Deploy certificate transparency monitoring for your organization's domains

Monitoring Recommendations

• Enable detailed logging on Uniffle Coordinator services to track client connection sources
• Implement network segmentation monitoring between Uniffle client and coordinator tiers
• Deploy endpoint detection solutions capable of identifying SSL interception tooling
• Monitor for unauthorized network devices or processes that could facilitate MITM attacks

How to Mitigate CVE-2025-68637

Immediate Actions Required

• Upgrade all Apache Uniffle installations to version 0.10.0 or later immediately
• Audit network infrastructure between Uniffle clients and coordinators for signs of compromise
• Implement network segmentation to limit potential MITM attack surfaces
• Review all historical Uniffle communications for potential data exposure

Patch Information

Apache has addressed this vulnerability in Uniffle version 0.10.0. The fix enables proper SSL certificate validation and hostname verification by default, ensuring that all REST API communications between the Uniffle CLI/client and Coordinator service are protected against MITM attacks.

Users should upgrade to version 0.10.0 as recommended in the Apache Security Mailing List. Additional technical discussion is available on the OpenWall OSS-Security Discussion.

Workarounds

• Isolate Uniffle client-to-coordinator traffic on dedicated network segments with strict access controls
• Implement additional network-level encryption (IPsec, WireGuard) between Uniffle components as a defense-in-depth measure
• Deploy network monitoring to detect potential MITM attacks while awaiting the upgrade
• Consider temporarily disabling Uniffle services in high-risk environments until the patch can be applied

# Verify Uniffle version after upgrade
uniffle version
# Expected output: 0.10.0 or higher

# Review SSL/TLS configuration in updated installation
grep -r "ssl" /path/to/uniffle/conf/