CVE-2025-9571 Details
Description
A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. This could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure. The following CDAP versions include the necessary update to protect against this vulnerability: * 6.10.6+ * 6.11.1+ Users must immediately upgrade to them, or greater ones, available at: https://github.com/cdapio/cdap-build/releases .
A remote code execution vulnerability has been identified in Google Cloud Data Fusion. This issue allows users with permission to upload artifacts to a Data Fusion instance to execute arbitrary code within the core AppFabric component. Exploitation of this vulnerability could enable an attacker to gain control over the Data Fusion instance, leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.
Users are advised to upgrade to Google Cloud Data Fusion versions 6.10.6 or 6.11.1 or later. The updated versions are available on the CDAP GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 10, 2025CISA-ADP
Assessed Dec 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.cloud.google.com/support/bulletins#gcp-2025-076 | GoogleCloud | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | GoogleCloud |
Affected Products
| Product | Versions |
|---|---|
| Google Cloud Data Fusion | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | GoogleCloud |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 10, 2025 | New CVE Received | GoogleCloud |