Apache HertzBeat incomplete XPath validation in aliasFields
Original title: CVE-2026-114442: Apache HertzBeat: incomplete XPath expression validation in aliasFields
Low severity vulnerability in Apache HertzBeat versions 1.7.1 to 1.9.1 allows authenticated users to supply malicious XPath expressions.
Apache HertzBeat has incomplete XPath expression validation in the HTTP collector XML parsing path for aliasFields. An authenticated user with permission to create monitor templates can supply malicious XPath. Versions affected include 1.7.1, 1.7.2, 1.7.3, 1.8.0, 1.9.0, and 1.9.1. No fixed versions stated.
Unconfirmed: No fixed versions provided in advisory
- Incomplete XPath validation in HTTP collector
- Affects multiple versions 1.7.1-1.9.1
- Authenticated monitor template creation
- Low severity
- Affects aliasFields in XML parsing
Impact: Malicious XPath in monitor templates
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114442 | XPath validation bypass in Apache HertzBeat aliasFields before 1.9.1 | 6.5 | — |
From the original article
Posted by Qingran Zhao on Nov 03 Severity: low Affected versions: - Apache HertzBeat 1. 7. 1 - Apache HertzBeat 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.