CVE-2026-49326
published 2026-07-24CVE-2026-49326: Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.49%
41.4th percentile
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hbase | < 2.5.15 | 2.5.15 |
| apache | hbase | — | — |
| apache | hbase | — | — |
| apache | hbase | — | — |
| apache | hbase | — | — |
| apache | hbase | — | — |
| apache | hbase | >= 2.6.0 < 2.6.6 | 2.6.6 |
| apache_software_foundation | apache_hbase | <= 2.5.14 | — |
| apache_software_foundation | apache_hbase | 2.6-alpha – 2.6.5 | — |
| apache_software_foundation | apache_hbase | 3-alpha – 3.0.0-beta-1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache HBase up to 2.5.14/2.6.5/3.0.0 Thrift/Rest Delegation Service improper authorization
vuldb·2026-08-10·CVSS 6.5
CVE-2026-49326 [MEDIUM] Apache HBase up to 2.5.14/2.6.5/3.0.0 Thrift/Rest Delegation Service improper authorization
A vulnerability described as critical has been identified in Apache HBase up to 2.5.14/2.6.5/3.0.0. Impacted is an unknown function of the component Thrift/Rest Delegation Service. The manipulation results in improper authorization.
This vulnerability is identified as CVE-2026-49326. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
ghsa_unreviewed·2026-07-24
CVE-2026-49326 [MEDIUM] CWE-862 Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-24
Published