CVE-2026-24343: 
Apache HertzBeat vulnerability analysis and mitigation

CVE-2026-24343 is an XPath Injection vulnerability (CWE-643) in Apache HertzBeat that allows low-privileged network attackers to manipulate XPath-based data queries, potentially leading to complete system compromise. It affects Apache HertzBeat versions 1.7.1 through 1.7.x (before 1.8.0), specifically the org.apache.hertzbeat:hertzbeat-collector component. The vulnerability was disclosed on February 9–10, 2026, with a patch released in version 1.8.0. It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, OSS-Sec).

The vulnerability is classified as CWE-643 (Improper Neutralization of Data within XPath Expressions), meaning user-supplied input is not properly sanitized before being incorporated into XPath queries within the HertzBeat collector component. An attacker with low-level network access and valid credentials can craft malicious XPath expressions to manipulate query logic, bypass access controls, or extract unauthorized data. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once authenticated. The vulnerability was reported by Qingran Zhao and disclosed via the Apache security mailing list and OSS-Security (OSS-Sec, Apache Mailing List).

Successful exploitation of this vulnerability results in high confidentiality, integrity, and availability impact on the affected HertzBeat instance. Attackers can read sensitive monitoring data, modify or delete information managed by the system, and potentially disrupt service availability through uncontrolled resource consumption via crafted XPath expressions. The scope is unchanged, meaning impact is confined to the vulnerable component, but the severity of that impact is complete across all three security dimensions (OSS-Sec, Red Hat Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Apache has released version 1.8.0 of HertzBeat, which resolves this vulnerability; all users running versions 1.7.1 through 1.7.x are strongly recommended to upgrade immediately. As interim mitigations, restrict network access to HertzBeat instances to authorized and trusted users only, and monitor application logs for anomalous or malformed XPath query patterns. Implementing input validation and parameterized queries at the application layer can further reduce injection risk (OSS-Sec, Apache Mailing List).

The vulnerability was noted by security aggregators and monitoring services shortly after disclosure, including coverage on SecurityOnline and INCIBE-CERT. Qualys included it in their February 2026 application security detections publication. Community discussion was limited, with no major vendor statements beyond the Apache disclosure itself (Red Hat Advisory).