CVE-2026-49326 in HBase
Summary
by MITRE • 07/24/2026
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability described represents a critical missing authorization check within Apache HBase's thrift and REST delegation services that fundamentally undermines the security model of the database system. This flaw exists in the scan operation implementation where three distinct steps are executed: open, fetch (which may occur multiple times), and close. During the open phase, the service generates a unique identifier that serves as a reference token for tracking scanner instances stored server-side. The vulnerability manifests when the fetch and close operations lack proper owner verification mechanisms, allowing unauthorized users to access data belonging to other users and potentially disrupt their scanning sessions.
This authorization bypass vulnerability directly relates to CWE-862 which defines insufficient authorization conditions in software systems, specifically targeting the failure to verify that an operation is being performed by an authorized user. The flaw enables what cybersecurity professionals term privilege escalation through resource manipulation, where malicious actors can leverage valid scanner identifiers to access sensitive data they should not have permission to retrieve. The impact extends beyond simple data exposure as it also permits users to terminate scanning sessions belonging to other authenticated entities, creating potential denial-of-service conditions that compromise system availability.
From an operational perspective, this vulnerability affects multiple release branches of Apache HBase including the major versions 2.4., 2.5. (through 2.5.14), 2.6.* (through 2.6.5), and the 3.0.0-alpha-1 through 3.0.0-beta-1 series, indicating a widespread issue affecting both stable and development branches of the software. The implications align with ATT&CK technique T1078.004 which covers legitimate credentials and privileges, as attackers could exploit this weakness to access data they shouldn't be authorized to view while maintaining operational continuity through the legitimate service interfaces.
The vulnerability creates a scenario where users can execute operations against scanner resources they do not own, fundamentally breaking the principle of least privilege that security architects rely upon in distributed database systems. When considering the broader attack surface, this flaw allows for unauthorized data exfiltration, session hijacking, and potential disruption of legitimate user operations. The fix requires upgrading to patched versions including 3.0.0-beta-2, 2.6.6, and 2.5.15 which implement proper authorization checks in the fetch and close operations, ensuring that each scanner resource can only be accessed by its original creator or authorized administrators.
Organizations utilizing Apache HBase should immediately assess their deployment environments to identify affected versions and implement the recommended upgrades as a priority. The vulnerability demonstrates how seemingly minor implementation gaps in access control mechanisms can create significant security risks in enterprise database systems where data integrity and confidentiality are paramount. This issue serves as a reminder of the critical importance of comprehensive authorization testing, particularly in distributed systems where multiple concurrent operations may share common resource identifiers that require proper ownership verification at each access point.