Apache HugeGraph CVE-2024-27348: Gremlin RCE, Exploited

What to do

1. Find every HugeGraph-Server instance, including containers and test clusters, and record its version.
2. Upgrade to the current release, at minimum 1.5.0, and run it on Java 11 or later as the advisory requires.
3. Enable authentication in rest-server.properties, gremlin-server.yaml and each graph's properties file; it is off by default.
4. Remove the REST and Gremlin endpoints from the internet and limit them to application hosts with a firewall or the IP whitelist.
5. If a server was reachable and unpatched after June 2024, investigate it and rotate credentials stored on the host.

How to check if you are affected or compromised

• Search reverse-proxy and load-balancer logs for POST /gremlin requests from addresses that are not your applications.
• Look for shells, curl, wget or unknown binaries spawned by the HugeGraph Java process, and for new cron jobs or SSH keys on the host.
• Check for unexpected outbound connections or sustained high CPU from the HugeGraph host, which can indicate a dropped payload.
• If request bodies are logged, look for Gremlin scripts that touch Thread names, reflection, ProcessBuilder or Runtime.

What happened#

On April 22, 2024, the Apache HugeGraph project disclosed CVE-2024-27348, a remote command execution flaw in HugeGraph-Server, a graph database that accepts Gremlin traversal scripts over its REST API. The advisory covers versions 1.0.0 up to 1.3.0 on Java 8 and Java 11. It rates the bug "important". The fix is to upgrade to 1.3.0, run it on Java 11 and enable the Auth system. The CVE record has no CNA score. NVD and CISA both rate it CVSS 3.1 9.8, with no privileges or user action needed.

SecureLayer7's June 5, 2024 analysis explains the root cause. HugeGraph runs Gremlin scripts inside a sandbox built on a custom HugeSecurityManager. That class decided whether a call came from Gremlin partly by checking the thread name, which had to start with gremlin-server-exec or task-worker. A script could use reflection to rename its own thread, step outside the check and then start ProcessBuilder. A crafted script sent to /gremlin therefore ran operating system commands. The 1.3.0 patch adds reflection filtering.

Public exploits appeared in early June. According to SecurityWeek, the Shadowserver Foundation reported in mid-July 2024 that attacks had started on June 6 and came from eight IP addresses. The Hacker News quotes it seeing "POST /gremlin" attempts from multiple sources. CISA added the CVE to the KEV catalog on September 18, 2024. Who was behind the attacks, and what they installed, was not disclosed as of Oct 23, 2026. Uptycs showed in a lab that the bug can drop a coinminer.

Who is affected#

HugeGraph-Server 1.0.0 up to 1.3.0, on Java 8 or Java 11. The bigger issue is configuration: the project's documentation says HugeGraph "disables user authentication by default". Its security guide treats DSL queries run with Auth disabled as a known risk, not a new vulnerability. An open Gremlin endpoint without Auth is dangerous on any version.

Do you really need to act?#

Only if you run HugeGraph. It is a niche product, and the bug is two and a half years old. For a HugeGraph user, though, the stakes are full remote code execution with no login, an exploit public since June 2024, and confirmed scanning. Check the version, and who can reach the REST port. Patching 27348 is not enough on its own. CVE-2024-43441, an authentication bypass through a fixed JWT secret, affects every version before 1.5.0. The releases page lists 1.7.0 as the latest.

What to do now#

1. Inventory HugeGraph-Server deployments, including containers and test clusters, and note each version.
2. Upgrade to a current release, at least 1.5.0. Run it on Java 11 or later (java -version).
3. Enable Auth: set auth.authenticator=org.apache.hugegraph.auth.StandardAuthenticator in conf/rest-server.properties, set the matching authenticator in conf/gremlin-server.yaml, and set gremlin.graph=org.apache.hugegraph.auth.HugeFactoryAuthProxy for each graph. Then set a strong admin password with bin/init-store.sh.
4. Generate a unique auth.token_secret with openssl rand -base64 32.
5. Keep the REST and Gremlin endpoints off the internet. Allow only application hosts.

How to tell if you were hit#

• Search proxy or load-balancer logs for POST /gremlin from unfamiliar addresses, especially after June 6, 2024.
• On the host, look for child processes of the HugeGraph Java process: ps -ef --forest. Also check new cron entries, ~/.ssh/authorized_keys and files in /tmp.
• Watch for unexplained outbound traffic or sustained CPU load, a common sign of a miner.

Timeline#

• Apr 22, 2024 — Apache discloses CVE-2024-27348; the fix is in 1.3.0.
• Jun 5, 2024 — SecureLayer7 publishes technical details; public exploits follow.
• Jun 6, 2024 — Exploitation attempts begin, per Shadowserver.
• Jul 17, 2024 — SecurityWeek and The Hacker News report Shadowserver's alert of in-the-wild attacks.
• Sep 18, 2024 — CISA adds the CVE to KEV, with an October 9 deadline.
• Dec 24, 2024 — CVE-2024-43441 (fixed JWT secret) is published, fixed in 1.5.0.

Vulnerability records

• CVE-2024-27348 · KEV 2024-09-18 · RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apache HugeGraph — CVE-2024-27348: Command execution in gremlin (oss-security, Apr 22, 2024) openwall.com
2. Apache HugeGraph — Security guide hugegraph.apache.org
3. Apache HugeGraph — Authentication configuration hugegraph.apache.org
4. CVE record — CVE-2024-27348 cve.org
5. NVD — CVE-2024-27348 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-27348 cisa.gov
7. CVE record — CVE-2024-43441 cve.org
8. Apache HugeGraph — GitHub releases github.com
9. SecureLayer7 — Remote Code Execution in Apache HugeGraph blog.securelayer7.net
10. Uptycs — Apache HugeGraph vulnerability uptycs.com

Coverage and analysis

1. SecurityWeek — Apache HugeGraph vulnerability exploited in the wild securityweek.com
2. The Hacker News — Critical Apache HugeGraph vulnerability under attack thehackernews.com