Executive brief
Apache Atlas is a metadata governance platform used to manage and track data assets across organizations. An authenticated user can inject malicious scripts into the Atlas UI, which could allow them to perform unauthorized actions, steal session cookies, or compromise other users' accounts. While the attack requires prior authentication, it could enable privilege escalation or lateral movement within a data governance environment.
Technical details
This vulnerability is a stored cross-site scripting (XSS) vulnerability in the Apache Atlas Dashboard UI, specifically in the Create Entity page (CWE-80: Improper Neutralization of Script-Related HTML Tags). An authenticated user can inject unfiltered HTML/JavaScript into the Atlas UI, which is then rendered without proper sanitization. The attack vector is network-based with low attack complexity, and requires user interaction (UI:R) and authentication (PR:L). An attacker with valid credentials can execute arbitrary JavaScript in the context of other users' browsers, potentially exfiltrating data or performing unauthorized operations. The vulnerability is patched in version 2.5.0, which includes upgraded package dependencies and improved input sanitization.
Affected products
- Apache Atlas 2.4.0 and earlier
Timeline
- 2026-06-22: disclosed: Vulnerability published in GitHub Advisory Database and NVD
- 2026-02-25: patched: Fix committed to apache/atlas repository (commit 800f979)