Apache Livy allows a malicious configuration of Spark settings to be passed through its REST or JDBC interface. When set to a value supported from Apache Spark 3.1 onwards, it can cause Livy to read or access files that the user does not have permission to read, resulting in unauthorized file access. The vulnerability is a classic CWE‑20 input validation flaw, leading to a confidentiality breach. The likely attack vector is remote network access to Livy’s REST/JDBC API, requiring an authenticated or accessible session.

This flaw affects Apache Livy versions 0.7.0 and 0.8.0 when they are connected to Apache Spark 3.1 or later. The issue is present only in environments where the Livy server can receive arbitrary Spark configuration values via its REST or JDBC endpoints.

The CVSS v3 base score is 6.3, indicating a moderate severity. The EPSS score is below 1 %, implying a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to have access to Livy’s REST or JDBC interface, which may be protected by authentication or network segmentation. Nonetheless, because the data accessed can be highly sensitive, the risk remains significant for exposed or poorly secured deployments.