CVE-2026-49326
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
24/07/2026
Last modified:
06/08/2026
Description
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.<br />
<br />
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.<br />
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.<br />
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.<br />
<br />
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.<br />
<br />
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:* | 2.5.15 (excluding) | |
| cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:* | 2.6.0 (including) | 2.6.6 (excluding) |
| cpe:2.3:a:apache:hbase:3.0.0:alpha1:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:alpha2:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:alpha3:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:alpha4:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:beta1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page