CVE-2025-26866
Severity CVSS v4.0:
Pending analysis
Type:
CWE-502
Deserialization of Untrusted Dat
Publication date:
12/12/2025
Last modified:
12/12/2025
Description
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.<br />
<br />
<br />
<br />
<br />
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH