CVE-2018-11760: When using PySpark , it's possible for a different local user to connect to the Spark application and imper...

Security readout for executives and security teams

CVE-2018-11760 affects Apache Spark when using PySpark. A different local user on the same system may connect to a Spark application and impersonate the user running it. Business risk is highest on shared analytics servers, multi-user clusters, or environments where untrusted users have local access. Organizations using affected Apache Spark versions with PySpark on shared hosts or clusters are most exposed. Single-user, isolated systems have lower practical exposure because the described attacker is another local user. Treat as a targeted remediation item for shared Spark environments. It is not supported as internet-exploited from the provided sources, but it can undermine user separation where multiple users share Spark infrastructure. Mitigation focus: Identify Spark deployments using affected versions and PySpark.; Review Apache Spark security guidance for the appropriate fixed or supported version.; Prioritize upgrades or migration from listed affected versions..

Prepared

Jun 7, 2026, 00:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.