CVE-2026-49326 Details
Description
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
A missing authorization vulnerability has been identified in the Apache HBase Thrift and REST delegation services. The issue arises during the scan operation, which consists of three steps: open, fetch (which can be repeated multiple times), and close. The open step generates an ID that is used to identify scanner instances stored on the server. However, the fetch and close steps lack an owner check, allowing users to access rows from scanners opened by others and to close scanners that belong to other users. This vulnerability affects Apache HBase versions 3.0.0-alpha-1 through 3.0.0-beta-1, 2.6.0 through 2.6.5, 2.5.0 through 2.5.14, and versions in the 2.4.x range.
Users are advised to upgrade to Apache HBase versions 3.0.0-beta-2, 2.6.6, or 2.5.15, all of which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/24/23 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/f4l4sjgwb9tb04cqnkpgl6gy3slgvcsj | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache hbase | < 2.5.15 >= 2.6.0, < 2.6.6 3.0.0 alpha1 3.0.0 alpha2 3.0.0 alpha3 3.0.0 alpha4 3.0.0 beta1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | CVE Modified | CVE |
| Jul 24, 2026 | New CVE Received | [email protected] |