CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326

The Apache HBase thrift and REST delegation services are vulnerable to a Missing Authorization flaw in the scanner handling of the hbase-thrift package. The root cause is a failure to verify ownership during the fetch and close steps of a scan operation; while the open step returns a scanner ID, ...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...