CVE-2026-32773 Overview
CVE-2026-32773 is a cross-site scripting (XSS) vulnerability in the Apache Spark History Server prior to version 3.5.8. The server fails to escape user-controlled content rendered in its web interface. A malicious Spark job can inject arbitrary unescaped frontend code that executes in the browser of any user visiting the Spark history page. Successful exploitation yields a limited privilege escalation within the victim's browser context. Exploitation requires two conditions: an attacker with permission to submit Spark jobs, and a higher-privileged user who authenticates to and visits the affected history page. The Apache Spark project addressed the flaw in Spark 3.5.8.
Critical Impact
Authenticated Spark users can inject browser-executed script into the history UI, potentially hijacking sessions of privileged operators who view job history.
Affected Products
- Apache Spark History Server versions prior to 3.5.8
- Deployments exposing the Spark history web UI to multi-tenant job submitters
- Managed Spark environments bundling vulnerable upstream builds
Discovery Timeline
- 2026-09-02 - CVE-2026-32773 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-32773
Vulnerability Analysis
The Apache Spark History Server renders metadata from completed Spark applications, including job names, stage descriptions, and other attributes supplied at job submission. Prior to version 3.5.8, the server rendered several of these fields into HTML responses without applying output encoding. An attacker who submits a Spark job can embed HTML or JavaScript payloads into these fields. When a privileged user later browses the history UI, the browser parses and executes the attacker-controlled markup in the origin of the history server. This maps to CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.
Root Cause
The root cause is missing output escaping when the history server templates render job-supplied strings into HTML. Fields that should have been HTML-encoded were emitted verbatim, allowing script content to survive from job submission to browser render.
Attack Vector
Exploitation is network-based and requires user interaction. The attacker must first authenticate with sufficient permissions to submit a Spark job containing a crafted payload in an attribute that the history UI renders. The attacker then waits for a higher-privileged administrator or analyst to open the Spark history page and view the malicious job. Because the payload executes in the history server origin, the attacker can perform actions available to the victim's browser session against that server, such as reading DOM content or issuing authenticated requests. See the Apache mailing list thread and the OpenWall OSS-Security advisory for coordinating discussion.
Detection Methods for CVE-2026-32773
Indicators of Compromise
- Spark job names, application names, or descriptions containing HTML tags such as <script>, <img onerror=>, or javascript: URIs.
- Unusual outbound requests from analyst browsers to attacker-controlled hosts shortly after visiting /history endpoints.
- History server access logs showing job submissions with payload-like strings in submitted metadata fields.
Detection Strategies
- Inspect Spark event logs and application metadata for HTML control characters (<, >, ", ') in fields that should contain identifier-style values.
- Deploy a Content Security Policy (CSP) reporting endpoint on the history server and alert on script-src violations from history pages.
- Review browser telemetry from users who visit the history UI for anomalous script execution or cross-origin requests.
Monitoring Recommendations
- Correlate Spark job submission identity with any subsequent XSS-shaped strings surfaced in the history UI to attribute payload authors.
- Track access to the history server web UI by privileged accounts and alert on visits immediately following new job submissions from lower-trust users.
- Monitor upgrade status across Spark clusters to confirm all history servers report version 3.5.8 or later.
How to Mitigate CVE-2026-32773
Immediate Actions Required
- Upgrade all Apache Spark History Server deployments to version 3.5.8 or later.
- Restrict access to the history server web UI to trusted networks and authenticated administrators only.
- Audit existing Spark event logs for previously submitted jobs containing HTML or JavaScript in metadata fields and purge affected entries.
Patch Information
Apache Spark 3.5.8 introduces the required output encoding for user-supplied metadata rendered by the History Server. The fix is documented in the Apache mailing list announcement. Operators running older 3.x branches should plan an upgrade path to 3.5.8 or migrate to a supported release incorporating the fix.
Workarounds
- Limit Spark job submission permissions to trusted users until the upgrade is complete, since exploitation requires the ability to launch a job.
- Place the History Server behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts.
- Instruct privileged operators to avoid opening the history UI for untrusted applications until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
