CVE-2026-66256
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
Risk Assessment
An attacker with access to the REST API can execute arbitrary code on the server, potentially leading to full system compromise. Due to lack of support, the risk is high if the service is still in use.
Recommendation
It is recommended to discontinue use of Apache Shindig and migrate to a supported solution. If not possible, restrict access to the REST API to trusted users only and apply additional network security measures.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.