Missing Authorization in Apache HBase Thrift and REST Services

CVE-2026-49326

What is CVE-2026-49326?

The Missing Authorization vulnerability in Apache HBase's thrift and REST services allows unauthorized users to access and manipulate scanner instances opened by other users. During a scan operation, the existing authorization checks have failed to validate the owner during the fetch and close steps. As a result, an attacker could potentially fetch rows from scanners they do not own or close scanners belonging to other users, leading to unauthorized access to sensitive data. Users are advised to upgrade to the patched versions: 3.0.0-beta-2, 2.6.6, and 2.5.15 to mitigate this risk.

References