This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/spark-website.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 82bd4bb2a9 [html] Clarify some of the common "this is not a security"
bug type issues we receive (#712)
82bd4bb2a9 is described below
commit 82bd4bb2a9a792a3445608a05b0022b2a88637aa
Author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Oct 27 18:15:53 2026 +0000
[html] Clarify some of the common "this is not a security" bug type issues
we receive (#712)
---
site/documentation.html | 10 ++++++--
site/security.html | 53 +++++++++++++++++++++++++++++++++++++++++++
site/spark-connect/index.html | 6 +++++
3 files changed, 67 insertions(+), 2 deletions(-)
diff --git a/site/documentation.html b/site/documentation.html
index ef5f748cdf..27dbc5d6dd 100644
--- a/site/documentation.html
+++ b/site/documentation.html
@@ -377,18 +377,24 @@ Slides, videos and EC2-based exercises from each of these
are available online:
<h3>Books</h3>
<ul>
<li><a
href="https://www.oreilly.com/library/view/learning-spark-2nd/9781492050032/";>Learning
Spark, 2nd Edition</a>, by Jules S. Damji, Brooke Wenig, Tathagata Das and
Denny Lee (O'Reilly Media)</li>
+ <li><a
href="https://www.oreilly.com/library/view/high-performance-spark/9781098145842/";>High
Performance Spark, 2nd edition</a> by Holden Karau Adi Polak, and Rachel
Warren (O'Reilly Media)</li>
<li><a
href="https://www.oreilly.com/library/view/spark-the-definitive/9781491912201/";>Spark:
The Definitive Guide</a>, by Bill Chambers and Matei Zaharia (O'Reilly
Media)</li>
<li><a
href="https://www.manning.com/books/spark-in-action-second-edition";>Spark in
Action, 2nd Edition</a>, by Jean-Georges Perrin (Manning)</li>
<li><a
href="https://www.oreilly.com/library/view/advanced-analytics-with/9781491972946/";>Advanced
Analytics with Spark, 2nd Edition</a>, by Josh Wills, Sean Owen, Sandy Ryza
and Uri Laserson (O'Reilly Media)</li>
- <li><a href="https://www.manning.com/books/spark-graphx-in-action";>Spark
GraphX in Action</a>, by Michael Malak (Manning)</li>
+ <li><a href="https://www.manning.com/books/spark-graphx-in-action";>Spark
GraphX in Action</a>, by Michael Malak and Robin East (Manning)</li>
<li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/fast-data-processing-spark-second-edition";>Fast
Data Processing with Spark</a>, by Krishna Sankar and Holden Karau (Packt
Publishing)</li>
- <li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/machine-learning-spark";>Machine
Learning with Spark</a>, by Nick Pentreath (Packt Publishing)</li>
+ <li><a
href="https://www.packtpub.com/en-us/product/machine-learning-with-spark-9781785889936?utm_source=chatgpt.com";>Machine
Learning with Spark: Develop intelligent, distributed machine learning systems
, Second Edition</a>, by Rajdeep Dua, Manpreet Singh Ghotra, Brian O'Neill,
Stephen Boesch, Nick Pentreath (Packt Publishing)</li>
<li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/spark-cookbook";>Spark
Cookbook</a>, by Rishi Yadav (Packt Publishing)</li>
<li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/apache-spark-graph-processing";>Apache
Spark Graph Processing</a>, by Rindra Ramamonjison (Packt Publishing)</li>
<li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/mastering-apache-spark";>Mastering
Apache Spark</a>, by Mike Frampton (Packt Publishing)</li>
+ <li><a
href="https://www.oreilly.com/library/view/mastering-spark-with/9781492046363/";>Mastering
Spark with R</a> by Javier Luraschi, Kevin Kuo, and Edgar Ruiz (O'Reilly
Media)</li>
<li><a href="http://www.apress.com/9781484209653";>Big Data Analytics with
Spark: A Practitioner's Guide to Using Spark for Large Scale Data Analysis</a>,
by Mohammed Guller (Apress)</li>
<li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/large-scale-machine-learning-spark";>Large
Scale Machine Learning with Spark</a>, by Md. Rezaul Karim, Md. Mahedi Kaysar
(Packt Publishing)</li>
<li><a
href="https://www.packtpub.com/big-data-and-business-intelligence/big-data-analytics";>Big
Data Analytics with Spark and Hadoop</a>, by Venkat Ankam (Packt
Publishing)</li>
+ <li><a href="https://www.distributedcomputing4kids.com";>Distributed
Computing 4 Kids and Executives: Solving Hard Problems with Garden Gnomes and
ASF Spark</a>, by Holden Karau, Johnny Kiotis, Annalise Cole, and Toria
Laughlin (Pigs Can Fly Labs)</li>
+ <li><a
href="https://www.packtpub.com/en-us/product/pyspark-cookbook-9781788834254";>PySpark
Cookbook: Over 60 recipes for implementing big data processing and analytics
using Apache Spark and Python</a> by Tomasz Drabas and Denny Lee (Packt
Publishing)</li>
+ <li><a
href="https://www.oreilly.com/library/view/stream-processing-with/9781491944233/";>Stream
Processing with Apache Spark</a> by Gerard Maas and Francois Garillot
(O'Reilly Media)</li>
+ <li><a
href="https://www.oreilly.com/library/view/data-algorithms-with/9781492082378/";>Data
Algorithms With Spark</a> by Mahmoud Parsian (O'Reilly Media)</li>
</ul>
<h3>Examples</h3>
diff --git a/site/security.html b/site/security.html
index d94b35cd78..f6ce9d15d9 100644
--- a/site/security.html
+++ b/site/security.html
@@ -203,6 +203,41 @@ internet or untrusted networks. We recommend access within
trusted networks (com
private cloud environments), using restrict access to the Spark cluster with
robust authentication,
authorization, and network controls.</p>
+<h3>I found an exploit, but it requires authentication to be disabled, is that
a vulnerability?</h3>
+
+<p>No. Without authentication, anyone who can reach a Spark cluster can
already submit and execute arbitrary
+code on it by design (see above), so an exploit that only works with
authentication disabled demonstrates
+no additional risk. Such a deployment is inherently insecure, and reports of
this kind will be rejected.
+If you believe you have found an issue that works against a cluster with
authentication enabled, please
+report it.</p>
+
+<h3>I found an exploit, but it requires knowing the shared secret, is that a
vulnerability?</h3>
+
+<p>No. The shared secret (<code class="language-plaintext
highlighter-rouge">spark.authenticate.secret</code>) <em>is</em> the
credential: anyone who knows it is already
+authenticated and can submit and execute arbitrary code on the cluster by
design (see above). An exploit
+that requires knowing the secret demonstrates no access beyond what the secret
already grants, and
+reports of this kind will be rejected. If you have found a way to bypass
authentication or recover the
+secret without being given it (see, for example, <a
href="#CVE-2021-38296">CVE-2021-38296</a>), please report it.</p>
+
+<h3 id="spark-connect-user-isolation">I found that one authenticated user can
see or act on another user's session in the same driver (for example, via Spark
Connect's `user_id` / `session_id`), is that a vulnerability?</h3>
+
+<p>No. Spark does not support isolating users from each other within a single
driver. Anyone who holds
+a driver’s authentication credential has the same access as anyone else
who holds it, including access
+to sessions, jobs, and data belonging to other holders of that same
credential. This is the flip side of
+the point above: the credential is what grants access, not the identifiers
layered on top of it.</p>
+
+<p>Open-source Spark Connect does not provide user isolation. The <code
class="language-plaintext highlighter-rouge">user_id</code> and <code
class="language-plaintext highlighter-rouge">session_id</code> fields in a
+Spark Connect request are supplied by the client and used to route a request
to the right session; they
+are not an authorization boundary between different holders of the same
authentication credential.
+A shared token answers “is this caller allowed to talk to this server at
all,” not “which of the server’s
+users is this.” If mutually-untrusting users need isolation from each
other, give each one their own
+driver, and therefore their own credential, rather than sharing one endpoint
and token across them.</p>
+
+<p>Some vendors offer their own isolation or a multi-tenant version of Spark
Connect on top of
+open-source Spark. Issues with a vendor’s isolation or multi-tenant
version should be reported to
+that vendor. The same applies to other projects that add their own per-user
isolation (for example,
+Apache Kyuubi): report those to the project.</p>
+
<h3>Is loading a machine learning model secure? Who is responsible for model
security?</h3>
<p>Loading an Apache Spark ML model is equivalent to loading and executing
code within the Spark runtime.</p>
@@ -217,6 +252,24 @@ might execute arbitrary code, access sensitive data, or
compromise cluster nodes
This includes verifying the source, validating integrity, and applying
appropriate isolation and security controls
before loading or deploying a model.</p>
+<h3>Is loading a checkpoint secure?</h3>
+
+<p>No, not from an untrusted source. This applies to any kind of Spark
checkpoint – RDD checkpoints,
+Spark Streaming checkpoints, and Structured Streaming checkpoints alike. A
checkpoint directory holds
+serialized Spark internals: driver and operator state, and, depending on the
job or query, serialized
+closures such as the functions in a DStream graph. Spark deserializes and
reconstructs these when it recovers
+from a checkpoint. Recovering from a checkpoint you did not write, or whose
storage location is writable
+by someone else, is equivalent to loading and executing arbitrary code within
the Spark runtime, for the
+same reasons a Spark ML model is above.</p>
+
+<p>Checkpoints must be trusted: treat a checkpoint location the same way you
would treat the credential
+that authenticates to the driver, restrict write access to it accordingly, and
do not recover from a
+checkpoint whose provenance or integrity you cannot verify.</p>
+
+<h3>I noticed the Spark server can cause the client to execute code, is that a
problem?</h3>
+
+<p>No, this is intentional. The Spark client <em>must</em> trust the server
since the results that come back can be of complex types whose deserialization
can execute code. The final, smaller parts of a computation sometimes run on
the client or driver (depending on the deployment model). This applies to Spark
Connect as well: a client must trust the server it connects to.</p>
+
<h2>Known security issues</h2>
<h3 id="CVE-2025-55039">CVE-2025-55039: Apache Spark: RPC encryption defaults
to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext
modification attacks</h3>
diff --git a/site/spark-connect/index.html b/site/spark-connect/index.html
index 1149f3ab05..de8de7d520 100644
--- a/site/spark-connect/index.html
+++ b/site/spark-connect/index.html
@@ -290,6 +290,12 @@ df.Show(100, false)
<p>Due to the decoupled nature of client applications leveraging Spark
Connect, failures of the client are now decoupled from the Spark Driver. This
means that when a client application fails, its failure modes are completely
independent of the other applications and don’t impact the running Spark Driver
that may continue serving other client applications.</p>
+<h2 id="user-isolation">User isolation</h2>
+
+<p>Open-source Spark Connect does not isolate users who share a server.
Clients that can authenticate to a server share its sessions, jobs, and data.
<code class="language-plaintext highlighter-rouge">user_id</code> and <code
class="language-plaintext highlighter-rouge">session_id</code> route a request
to a session; they are not an authorization boundary.</p>
+
+<p>Some vendors offer their own isolation or a multi-tenant version of Spark
Connect. Issues with those should be reported to the vendor. See the <a
href="/security.html#spark-connect-user-isolation">Security</a> page.</p>
+
<h2 id="upgrading-to-spark-connect">Upgrading to Spark Connect</h2>
<p>Spark Connect does not support all the Spark JVM APIs. For example, Spark
JVM has private methods that some users leverage to execute arbitrary Java code
on Spark clusters. Spark Connect obviously cannot support those methods
because the Spark Connect client isn’t necessarily running Java!</p>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
