Apache HBase security advisories

Security information for Apache HBase

Reporting

Do you want disclose a potential security issue for Apache HBase? Send your report to the Apache Security Team.

You can read more about the security policy on:

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

Missing scanner instance owner check in thrift delegation service

CVE-2026-49326 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-24T14:56:20.732Z

Affected

  • Apache HBase through 2.5.14
  • Apache HBase from 2.6-alpha through 2.6.5
  • Apache HBase from 3-alpha through 3.0.0-beta-1

Description

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.

A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.

This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.

Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.

References

Credits