Missing Authorization in Apache HBase - CVE-2026-49326
Published: August 25, 2026
Vulnerability identifier: #VU145293
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49326
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and disrupt other users' scan operations.
The vulnerability exists due to improper access control in the thrift and rest delegation service scanner handling when processing fetch and close requests for existing scanner instances. A remote user can supply a scanner identifier associated with another user's scan operation to disclose sensitive information and disrupt other users' scan operations.
The issue affects the fetch and close steps of the scan workflow after a scanner instance has been opened on the server.
Affected software
Apache HBase
How to mitigate CVE-2026-49326
Install security update from vendor's website.
Apache HBase - addressed in versions 2.5.15, 2.6.6