CVE-2025-9571

A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. This could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.

The following CDAP versions include the necessary update to protect against this vulnerability: * 6.10.6+

• 6.11.1+

 Users must immediately upgrade to them, or greater ones, available at: https://github.com/cdapio/cdap-build/releases .

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Potential Mitigations

• Make fields transient to protect them from deserialization.
• An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/586.html

References

• https://docs.cloud.google.com/support/bulletins#gcp-2025-076