---
title: "Apache HugeGraph CVE-2024-27348: Gremlin RCE, Exploited"
url: https://erroneo.us/security/briefs/hugegraph-cve-2024-27348-gremlin-rce/
description: "HugeGraph-Server 1.0.0 to before 1.3.0 let anyone run OS commands via /gremlin, exploited since mid-2024. Upgrade, enable Auth, keep it off the internet."
type: security-brief
section: "Security Digest"
date_published: 2024-04-22
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-27348"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apache HugeGraph CVE-2024-27348: Gremlin RCE, Exploited

**Verdict: Check exposure.** Fixed in 1.3.0 in 2024 and exploited since June of that year; anyone still running an older HugeGraph-Server, or any version with Auth off and the REST API reachable, should treat the server as open to remote code execution.

- **Who must act:** Teams running self-hosted Apache HugeGraph-Server older than 1.3.0, or any version with the default no-auth setup reachable from untrusted networks.
- **Who can relax:** Teams that do not run HugeGraph, and those on a current release with Auth enabled and the REST API limited to trusted hosts.
- **Affected:** Apache HugeGraph-Server 1.0.0 through versions before 1.3.0, on Java 8 and Java 11
- **Fixed:** Apache HugeGraph-Server 1.3.0 on Java 11 with the Auth system enabled; Recommended today: a current release (1.7.0 is the latest on GitHub); 1.5.0 or later is also needed for CVE-2024-43441
- **CVEs:** CVE-2024-27348
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every HugeGraph-Server instance, including containers and test clusters, and record its version.
2. Upgrade to the current release, at minimum 1.5.0, and run it on Java 11 or later as the advisory requires.
3. Enable authentication in rest-server.properties, gremlin-server.yaml and each graph's properties file; it is off by default.
4. Remove the REST and Gremlin endpoints from the internet and limit them to application hosts with a firewall or the IP whitelist.
5. If a server was reachable and unpatched after June 2024, investigate it and rotate credentials stored on the host.

### How to check if you are affected

- Search reverse-proxy and load-balancer logs for POST /gremlin requests from addresses that are not your applications.
- Look for shells, curl, wget or unknown binaries spawned by the HugeGraph Java process, and for new cron jobs or SSH keys on the host.
- Check for unexpected outbound connections or sustained high CPU from the HugeGraph host, which can indicate a dropped payload.
- If request bodies are logged, look for Gremlin scripts that touch Thread names, reflection, ProcessBuilder or Runtime.

## What happened

On April 22, 2024, the Apache HugeGraph project disclosed CVE-2024-27348, a remote command execution flaw in HugeGraph-Server, a graph database that accepts Gremlin traversal scripts over its REST API. The [advisory](https://www.openwall.com/lists/oss-security/2024/04/22/3) covers versions 1.0.0 up to 1.3.0 on Java 8 and Java 11. It rates the bug "important". The fix is to upgrade to 1.3.0, run it on Java 11 and enable the Auth system. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-27348) has no CNA score. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-27348) and CISA both rate it CVSS 3.1 9.8, with no privileges or user action needed.

[SecureLayer7's June 5, 2024 analysis](https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/) explains the root cause. HugeGraph runs Gremlin scripts inside a sandbox built on a custom `HugeSecurityManager`. That class decided whether a call came from Gremlin partly by checking the thread name, which had to start with `gremlin-server-exec` or `task-worker`. A script could use reflection to rename its own thread, step outside the check and then start `ProcessBuilder`. A crafted script sent to `/gremlin` therefore ran operating system commands. The 1.3.0 patch adds reflection filtering.

Public exploits appeared in early June. According to [SecurityWeek](https://www.securityweek.com/apache-hugegraph-vulnerability-exploited-in-wild/), the Shadowserver Foundation reported in mid-July 2024 that attacks had started on June 6 and came from eight IP addresses. [The Hacker News](https://thehackernews.com/2024/07/critical-apache-hugegraph-vulnerability.html) quotes it seeing "POST /gremlin" attempts from multiple sources. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348) on September 18, 2024. Who was behind the attacks, and what they installed, was not disclosed as of Oct 23, 2026. [Uptycs](https://www.uptycs.com/blog/threat-research-report-team/apache-hugegraph-vulnerability) showed in a lab that the bug can drop a coinminer.

## Who is affected

HugeGraph-Server 1.0.0 up to 1.3.0, on Java 8 or Java 11. The bigger issue is configuration: the [project's documentation](https://hugegraph.apache.org/docs/config/config-authentication/) says HugeGraph "disables user authentication by default". Its [security guide](https://hugegraph.apache.org/docs/guides/security/) treats DSL queries run with Auth disabled as a known risk, not a new vulnerability. An open Gremlin endpoint without Auth is dangerous on any version.

## Do you really need to act?

Only if you run HugeGraph. It is a niche product, and the bug is two and a half years old. For a HugeGraph user, though, the stakes are full remote code execution with no login, an exploit public since June 2024, and confirmed scanning. Check the version, and who can reach the REST port. Patching 27348 is not enough on its own. [CVE-2024-43441](https://www.cve.org/CVERecord?id=CVE-2024-43441), an authentication bypass through a fixed JWT secret, affects every version before 1.5.0. The [releases page](https://github.com/apache/incubator-hugegraph/releases) lists 1.7.0 as the latest.

## What to do now

1. Inventory HugeGraph-Server deployments, including containers and test clusters, and note each version.
2. Upgrade to a current release, at least 1.5.0. Run it on Java 11 or later (`java -version`).
3. Enable Auth: set `auth.authenticator=org.apache.hugegraph.auth.StandardAuthenticator` in `conf/rest-server.properties`, set the matching authenticator in `conf/gremlin-server.yaml`, and set `gremlin.graph=org.apache.hugegraph.auth.HugeFactoryAuthProxy` for each graph. Then set a strong admin password with `bin/init-store.sh`.
4. Generate a unique `auth.token_secret` with `openssl rand -base64 32`.
5. Keep the REST and Gremlin endpoints off the internet. Allow only application hosts.

## How to tell if you were hit

- Search proxy or load-balancer logs for `POST /gremlin` from unfamiliar addresses, especially after June 6, 2024.
- On the host, look for child processes of the HugeGraph Java process: `ps -ef --forest`. Also check new cron entries, `~/.ssh/authorized_keys` and files in `/tmp`.
- Watch for unexplained outbound traffic or sustained CPU load, a common sign of a miner.

## Timeline

- Apr 22, 2024 — Apache discloses CVE-2024-27348; the fix is in 1.3.0.
- Jun 5, 2024 — SecureLayer7 publishes technical details; public exploits follow.
- Jun 6, 2024 — Exploitation attempts begin, per Shadowserver.
- Jul 17, 2024 — SecurityWeek and The Hacker News report Shadowserver's alert of in-the-wild attacks.
- Sep 18, 2024 — CISA adds the CVE to KEV, with an October 9 deadline.
- Dec 24, 2024 — CVE-2024-43441 (fixed JWT secret) is published, fixed in 1.5.0.

## Sources

1. [Apache HugeGraph — CVE-2024-27348: Command execution in gremlin (oss-security, Apr 22, 2024)](https://www.openwall.com/lists/oss-security/2024/04/22/3)
2. [Apache HugeGraph — Security guide](https://hugegraph.apache.org/docs/guides/security/)
3. [Apache HugeGraph — Authentication configuration](https://hugegraph.apache.org/docs/config/config-authentication/)
4. [CVE record — CVE-2024-27348](https://www.cve.org/CVERecord?id=CVE-2024-27348)
5. [NVD — CVE-2024-27348](https://nvd.nist.gov/vuln/detail/CVE-2024-27348)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-27348](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348)
7. [CVE record — CVE-2024-43441](https://www.cve.org/CVERecord?id=CVE-2024-43441)
8. [Apache HugeGraph — GitHub releases](https://github.com/apache/incubator-hugegraph/releases)
9. [SecureLayer7 — Remote Code Execution in Apache HugeGraph](https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/)
10. [Uptycs — Apache HugeGraph vulnerability](https://www.uptycs.com/blog/threat-research-report-team/apache-hugegraph-vulnerability)
11. [SecurityWeek — Apache HugeGraph vulnerability exploited in the wild](https://www.securityweek.com/apache-hugegraph-vulnerability-exploited-in-wild/)
12. [The Hacker News — Critical Apache HugeGraph vulnerability under attack](https://thehackernews.com/2024/07/critical-apache-hugegraph-vulnerability.html)

---
Source page: https://erroneo.us/security/briefs/hugegraph-cve-2024-27348-gremlin-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt