Missing Authorization

Apache HBase is vulnerable to Missing Authorization. The vulnerability is due to missing owner checks in the fetch and close steps, where the server uses the scanner ID returned by the open step to identify scanner instances but fails to verify that the ID belongs to the requesting user, allowing...

Missing Authorization

Overview org.apache.hbase:hbase-thrift is a HBase Thrift Server. Affected versions of this package are vulnerable to Missing Authorization in the REST ScannerInstanceResource and Thrift HBaseServiceHandler scanner handling. An attacker can read rows from, or close, another user’s open scanner by...

CVE-2026-49326

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

EUVD-2026-48610

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326

The Apache HBase thrift and REST delegation services are vulnerable to a Missing Authorization flaw in the scanner handling of the hbase-thrift package. The root cause is a failure to verify ownership during the fetch and close steps of a scan operation; while the open step returns a scanner ID, ...

CVE-2026-49326: Missing Authorization

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

PT-2026-64312

Name of the Vulnerable Software and Affected Versions Apache HBase versions 3.0.0-alpha-1 through 3.0.0-beta-1 Apache HBase versions 2.6.0 through 2.6.5 Apache HBase versions 2.5.0 through 2.5.14 Apache HBase versions prior to 2.4.1 Description An authorization flaw exists in the thrift and rest...

EUVD-2018-0678

Malware in sbrugna...

EUVD-2013-2148

Malware in sbrugna...

EUVD-2019-0402

Malware in sbrugna...

EUVD-2018-0650

Malware in sbrugna...

Security Bulletin: Vulnerabilities with DataStage on Cloud Pak for Data related to Apache hbase-client 2.4.15

Summary IBM has released the below fix for IBM DataStage on Cloud Pak for Data in response to multiple vulnerabilities found in components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2015-5237 DESCRIPTION: Google Protocol Buffers cou...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to LDAP injection due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-25613 DESCRIPTION: Apache Kerby could allow a remote attacker to conduct an LDAP injection, caused by a flaw in LdapIdentityBackend. By sending a request with ...

Apache Storm remote code execution vulnerability

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase...

GHSA-CG5H-Q983-4RWW Apache Storm remote code execution vulnerability

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase...

Unauthorized Access Vulnerability in Apache HBase

Apache Hbase is the United States Apache Apache Software Foundation, a set of column-oriented distributed database built on Apache Hadoop and Apache ZooKeeper. An unauthorized access vulnerability exists in Apache HBase. An attacker could exploit the vulnerability to obtain sensitive information...