CVE-2026-49326
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In Apache HBase, the thrift and REST services lack owner authorization in scanner fetch and close operations. A user can fetch rows from scanners opened by other users and close scanners belonging to others, breaking data isolation.
Risk Assessment
Missing owner checks allow unauthorized data access and disruption of other users' scanning sessions, potentially leading to data leaks or DoS attacks.
Recommendation
Upgrade Apache HBase to version 3.0.0-beta-2, 2.6.6, or 2.5.15, which include the fix adding owner checks in fetch and close operations.
Other vulnerabilities in Apache HBase
Original NVD description (English source)
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.