CVE-2025-26866: 
Java vulnerability analysis and mitigation

CVE-2025-26866 is a remote code execution vulnerability in Apache HugeGraph-Server affecting the PD store's Raft cluster communication layer. A malicious Raft node can exploit insecure Hessian deserialization to inject and execute arbitrary objects on the server. It affects Apache HugeGraph-Server versions 1.0.0 through 1.5.0 (all versions before 1.7.0). The vulnerability was publicly disclosed on December 9, 2025 via the oss-security mailing list and published to the NVD on December 12, 2025. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.1 (High) (Github Advisory, Openwall OSS-Sec).

The root cause is insecure deserialization (CWE-502) in the Hessian serialization layer used by the sofa-bolt/Raft communication components within the hg-pd-core module of Apache HugeGraph-Server. Prior to the fix, the PD store's Raft RPC server lacked both IP-based authentication for incoming cluster connections and a class whitelist for Hessian deserialization, allowing any network-reachable node to pose as a Raft peer and send crafted serialized payloads. An attacker controlling a malicious Raft node can send a specially crafted Hessian-serialized object to the PD store's RPC port, triggering arbitrary object instantiation and code execution during deserialization. The fix (PR #2735) introduces a HugegraphHessianSerializerFactory with a strict class whitelist and an IpAuthHandler that validates incoming connections against the configured peer list (Github Advisory, GitHub PR #2735).

Successful exploitation allows a remote attacker with low-privilege network access to the Raft RPC port to execute arbitrary code on the affected HugeGraph-Server node, resulting in full confidentiality, integrity, and availability compromise of the system. An attacker could manipulate or exfiltrate data stored in the PD store, disrupt the entire HugeGraph cluster, and potentially pivot to other networked resources accessible from the compromised server (Github Advisory, Openwall OSS-Sec).

1. Reconnaissance: Identify Apache HugeGraph-Server instances running versions 1.0.0–1.5.0 (before 1.7.0) with the PD store's Raft RPC port exposed on the network (default sofa-bolt port, typically 8686 or as configured).
2. Establish network access: Position a malicious node on the same network segment as the target HugeGraph PD store, or exploit any network path to the Raft RPC port.
3. Craft malicious Hessian payload: Construct a serialized Hessian object using a known Java deserialization gadget chain (e.g., via tools like ysoserial) targeting classes available on the HugeGraph server's classpath.
4. Send payload via sofa-bolt: Connect to the Raft RPC server endpoint and transmit the crafted Hessian-serialized payload as if initiating a legitimate Raft cluster communication, bypassing the absent IP authentication.
5. Achieve code execution: The server deserializes the malicious object without class validation, triggering the gadget chain and executing arbitrary commands as the HugeGraph service account, enabling reverse shell establishment, data exfiltration, or further lateral movement within the cluster (Github Advisory, GitHub PR #2735).

• Network: Unexpected inbound connections to the HugeGraph PD store's Raft RPC port (sofa-bolt) from IP addresses not in the configured peer list; unusual outbound connections from the HugeGraph server process to unknown external hosts.
• Logs: HugeGraph PD store logs showing Raft RPC connections from unauthorized IP addresses; Java deserialization errors or unexpected class instantiation events in application logs; sofa-bolt connection logs with anomalous source IPs.
• Process: Unusual child processes spawned by the HugeGraph Java process (e.g., /bin/bash, curl, wget, python, nc); unexpected network listeners or new processes running under the HugeGraph service account.
• File System: New or modified files in the HugeGraph installation directory, including unexpected scripts, web shells, or cron jobs created by the service account.

The primary remediation is to upgrade Apache HugeGraph-Server to version 1.7.0, which introduces IP-based authentication for Raft cluster membership and a strict Hessian class whitelist to prevent object injection (Github Advisory, GitHub PR #2735). As an interim workaround, implement network segmentation to restrict access to the Raft RPC port exclusively to trusted cluster peer IPs using firewall rules or security groups. Additionally, review and audit all nodes with access to the PD store's Raft communication port and monitor for suspicious deserialization activity.

The vulnerability was disclosed via the Apache oss-security mailing list and received standard community tracking coverage from vulnerability aggregators including VulDB, vulners.com, and CIRCL. Social media posts on Bluesky noted the advisory shortly after publication. No significant vendor statements beyond the Apache advisory or notable researcher commentary beyond the original reporters have been identified (Openwall OSS-Sec).