CVE-2026-49326
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
24/07/2026
Última modificación:
06/08/2026
Descripción
*** Pendiente de traducción *** Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.<br />
<br />
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.<br />
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.<br />
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.<br />
<br />
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.<br />
<br />
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:* | 2.5.15 (excluyendo) | |
| cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:* | 2.6.0 (incluyendo) | 2.6.6 (excluyendo) |
| cpe:2.3:a:apache:hbase:3.0.0:alpha1:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:alpha2:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:alpha3:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:alpha4:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:hbase:3.0.0:beta1:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página