CVE-2026-6213CWE-290CWE-807
Remote Spark SparkView RCE
Critical · published May 8, 2026
What it is
A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local connection check and achieve arbitrary code execution as root on the server side. Depending on implementation the vulnerability can be exploited by an unauthenticated attacker.
The record
Technical detail
- CVSS v4.0
- 10.0 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A
- EPSS
- 0.00552 · 45.3th percentile
- Weaknesses
- CWE-290 · Authentication Bypass by Spoofing; CWE-807 · Reliance on Untrusted Inputs in a Security Decision
- Published
- 2026-05-08T09:04Z
EPSS history
Timeline