External risk intelligence

Apache Submarine Core Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-36265

Apache Submarine is a machine learning platform designed for data science workflows. While these systems are typically deployed within internal or restricted research environments, they may occasionally be exposed as web-based interfaces or API endpoints for team collaboration, making internet accessibility plausible depending on the specific organizational deployment configuration.

Apache Submarine

0.8.0 and later

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Apache Submarine Server Core that allows unauthenticated access via crafted requests. Since this project is retired and unsupported, there will be no official fix, and affected users should seek alternatives or restrict network access to the instance.

Authentication bypass in retired server software.
Matters if you use or supported this retired software.
Confirm relevance and exposure of this retired software.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable Apache Submarine Server Core by sending specially crafted REST requests over the network. This bypasses authentication, potentially granting the attacker unauthorized access to the system and its data. Since the project is retired, there is no fix available, and access should be restricted to trusted users.

No authentication required to access.
Triggered by specially crafted REST requests.
Leads to unauthorized access and data compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could bypass authentication by sending specially crafted REST requests to the Apache Submarine Server Core, potentially affecting system data and service behavior.

System data could be affected.
Authentication bypass via crafted requests.
Unauthorized access and potential data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

As Apache Submarine Server Core is retired and unsupported, the primary responsibility falls on the teams managing the application's lifecycle and infrastructure. The first practical step is to immediately identify all instances of Apache Submarine, assess their exposure, and determine their criticality, given that no patches are available. If the instances are deemed necessary, immediate action should focus on implementing compensating controls, such as network segmentation or access restrictions, and exploring alternative solutions.

Application or infrastructure owners must take ownership.
Verify instance exposure and business criticality.
Restrict access and plan for alternatives.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Submarine?

Apache Submarine is a specialized platform designed to manage machine learning and data science workflows. It provides a server component that teams often use to coordinate experiments, manage infrastructure, and collaborate on data-driven projects within an organizational environment.

What does CVE-2024-36265 mean?

This CVE identifies an Incorrect Authorization vulnerability, categorized as CWE-863. In plain terms, it means the software fails to verify who a user is before granting them access. Because of this flaw, the server can be tricked into letting someone perform actions or view data without needing to log in first.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted REST API requests to the Apache Submarine Server. The vulnerability is triggered solely by these malicious network messages; standard, legitimate interactions that do not include the specific crafted request structure will not exploit this authentication bypass.

Do I need to worry about this vulnerability?

You should care if your organization runs Apache Submarine, especially if the interface is reachable over a network. According to Halo Surface Signal, while these platforms are typically kept in internal research environments, they are occasionally deployed as web interfaces or API endpoints, which increases the risk if they are accessible from broader networks.

What should I do if I am running this software?

Since Apache Submarine is retired and no patches will be issued, you must take manual control. First, identify all running instances. Because there is no fix, you should immediately restrict network access to these servers so only trusted users can reach them, and prioritize migrating your workflows to a supported alternative.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.