Missing Authorization

Apache HBase is vulnerable to Missing Authorization. The vulnerability is due to missing owner checks in the fetch and close steps, where the server uses the scanner ID returned by the open step to identify scanner instances but fails to verify that the ID belongs to the requesting user, allowing...

com.expediagroup:drone-fly-app (>=1.0.9, <=1.0.10), org.apache.hive:hive-beeline (>=4.0.0-alpha-1, <=4.2.0) +3 more potentially affected by CVE-2026-49845 via org.apache.hive:hive-standalone-metastore-server (>=4.0.0-alpha-1, <=4.2.0)

org.apache.hive:hive-standalone-metastore-server MAVEN version =4.0.0-alpha-1, =1.0.9, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.1.0, =4.1.0, =4.2.0 Source cves: CVE-2026-49845 Source advisory: SNYK:JAVA-ORGAPACHEHIVE-19256918...

com.expediagroup:drone-fly-app (>=1.0.9, <=1.0.10), org.apache.hive:hive-beeline (>=4.0.0-alpha-1, <=4.2.0) +3 more potentially affected by CVE-2026-49845 via org.apache.hive:hive-standalone-metastore-server (>=4.0.0-alpha-1, <=4.2.0)

org.apache.hive:hive-standalone-metastore-server MAVEN version =4.0.0-alpha-1, =1.0.9, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.1.0, =4.1.0, =4.2.0 Source cves: CVE-2026-49845 Source advisory: MEND:CVE-2026-49845...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=0.2.1, <=0.3.0), org.apache.hbase:hbase-assembly (>=3.0.0-alpha-1, <=3.0.0-alpha-3) +2 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.0.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =0.2.1,...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=0.2.1, <=0.3.0), org.apache.hbase:hbase-assembly (>=3.0.0-alpha-1, <=3.0.0-alpha-3) +2 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.0.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =0.2.1,...

org.apache.hbase:hbase-assembly (>=2.5.0, <=3.0.0-beta-1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.15.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.apache.hbase:hbase-assembly =2.5.0, =3.0.0-beta-1 Sour...

Apache Hbase Unauth Detection

Apache Hbase is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Hbase is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Hbase Unauth Detection', 'description': 'Apache Hbase is exposed.'...

Missing Authorization

Overview org.apache.hbase:hbase-thrift is a HBase Thrift Server. Affected versions of this package are vulnerable to Missing Authorization in the REST ScannerInstanceResource and Thrift HBaseServiceHandler scanner handling. An attacker can read rows from, or close, another user’s open scanner by...

org.apache.hbase:hbase-assembly (>=2.5.0, <=2.5.13-hadoop3), org.apache.hbase:hbase-examples (>=2.5.0, <=2.5.13-hadoop3) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-thrift (>=2.5.0, <=2.5.13-hadoop3)

org.apache.hbase:hbase-thrift MAVEN version =2.5.0, =2.5.0, =2.5.0, =2.5.13-hadoop3 Source cves: CVE-2026-49326 Source advisory: SNYK:JAVA-ORGAPACHEHBASE-19500661...

org.apache.hbase:hbase-assembly (>=2.6.0, <=2.6.4-hadoop3), org.apache.hbase:hbase-examples (>=2.6.0, <=2.6.4-hadoop3) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-thrift (>=2.6.0, <=2.6.4-hadoop3)

org.apache.hbase:hbase-thrift MAVEN version =2.6.0, =2.6.0, =2.6.0, =2.6.4-hadoop3 Source cves: CVE-2026-49326 Source advisory: SNYK:JAVA-ORGAPACHEHBASE-19500661...

CVE-2026-49326

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-49326

The Apache HBase thrift and REST delegation services are vulnerable to a Missing Authorization flaw in the scanner handling of the hbase-thrift package. The root cause is a failure to verify ownership during the fetch and close steps of a scan operation; while the open step returns a scanner ID, ...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

EUVD-2026-48610

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

org.apache.hbase:hbase-assembly (>=3.0.0-alpha-1, <=3.0.0-beta-1), org.apache.hbase:hbase-examples (>=3.0.0-alpha-1, <=3.0.0-beta-1) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-thrift (>=3.0.0-alpha-1, <=3.0.0-beta-1)

org.apache.hbase:hbase-thrift MAVEN version =3.0.0-alpha-1, =3.0.0-alpha-1, =3.0.0-alpha-1, =3.0.0-beta-1 Source cves: CVE-2026-49326 Source advisory: MEND:CVE-2026-49326...

org.apache.hbase:hbase-assembly (>=2.6.0, <=2.6.4-hadoop3), org.apache.hbase:hbase-examples (>=2.6.0, <=2.6.4-hadoop3) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-rest (>=2.6.0, <=2.6.4-hadoop3)

org.apache.hbase:hbase-rest MAVEN version =2.6.0, =2.6.0, =2.6.0, =2.6.4-hadoop3 Source cves: CVE-2026-49326 Source advisory: MEND:CVE-2026-49326...

org.apache.hbase:hbase-assembly (>=2.5.0, <=2.5.13-hadoop3), org.apache.hbase:hbase-examples (>=2.5.0, <=2.5.13-hadoop3) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-rest (>=2.5.0, <=2.5.13-hadoop3)

org.apache.hbase:hbase-rest MAVEN version =2.5.0, =2.5.0, =2.5.0, =2.5.13-hadoop3 Source cves: CVE-2026-49326 Source advisory: MEND:CVE-2026-49326...

org.apache.hbase:hbase-assembly (>=2.5.0, <=2.5.13-hadoop3), org.apache.hbase:hbase-examples (>=2.5.0, <=2.5.13-hadoop3) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-thrift (>=2.5.0, <=2.5.13-hadoop3)

org.apache.hbase:hbase-thrift MAVEN version =2.5.0, =2.5.0, =2.5.0, =2.5.13-hadoop3 Source cves: CVE-2026-49326 Source advisory: MEND:CVE-2026-49326...

org.apache.hbase:hbase-assembly (>=3.0.0-alpha-1, <=3.0.0-beta-1), org.apache.hbase:hbase-examples (>=3.0.0-alpha-1, <=3.0.0-beta-1) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-rest (>=3.0.0-alpha-1, <=3.0.0-beta-1)

org.apache.hbase:hbase-rest MAVEN version =3.0.0-alpha-1, =3.0.0-alpha-1, =3.0.0-alpha-1, =3.0.0-beta-1 Source cves: CVE-2026-49326 Source advisory: MEND:CVE-2026-49326...

org.apache.hbase:hbase-assembly (>=2.6.0, <=2.6.4-hadoop3), org.apache.hbase:hbase-examples (>=2.6.0, <=2.6.4-hadoop3) potentially affected by CVE-2026-49326 via org.apache.hbase:hbase-thrift (>=2.6.0, <=2.6.4-hadoop3)

org.apache.hbase:hbase-thrift MAVEN version =2.6.0, =2.6.0, =2.6.0, =2.6.4-hadoop3 Source cves: CVE-2026-49326 Source advisory: MEND:CVE-2026-49326...