CVE-2026-49326

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-49326

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49326.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-49326

Published

2026-07-24T14:56:22Z

Modified

2026-08-12T03:51:28Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Apache HBase: Missing scanner instance owner check in thrift delegation service

Details

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.

A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.

This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.

Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49326.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "2.5.14"
                },
                {
                    "introduced": "2.6-alpha"
                },
                {
                    "last_affected": "2.6.5"
                },
                {
                    "introduced": "3-alpha"
                },
                {
                    "last_affected": "3.0.0-beta-1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "3.0.0-alpha-1"
                },
                {
                    "fixed": "3.0.0-beta-1"
                },
                {
                    "introduced": "2.6.0"
                },
                {
                    "fixed": "2.6.5"
                },
                {
                    "introduced": "2.5.0"
                },
                {
                    "fixed": "2.5.14"
                },
                {
                    "fixed": "2.4"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/hbase

Affected ranges

Type

GIT

Repo

https://github.com/apache/hbase

Events

Introduced

Fixed

1489aab3675f848300fea0a9cfc42fc26428cb49

Introduced

de99f8754135ea69adc39da48d2bc2b2710a5366

Fixed

d5f63f523c065f963992ea4e74db268d17816631

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.15"
        },
        {
            "introduced": "2.6.0"
        },
        {
            "fixed": "2.6.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*

2.0.0-alpha-1RC0

2.0.0-alpha-2RC0

2.0.0-alpha-3RC0.2

2.0.0-beta-1-RC0

2.0.0-beta-1-RC1

2.0.0-beta-1-RC1.2

2.0.0-beta-1-RC1.3

2.0.0-beta-1-RC1.4

2.0.0-beta-1-RC1.5

2.0.0-beta-1-RC1.6

2.0.0-beta-1-RC1.7

2.0.0-beta-2RC0.2

2.5.0RC0

2.5.0RC1

2.5.10RC0

2.5.10RC1

2.5.11RC0

2.5.11RC1

2.5.12RC0

2.5.13RC0

2.5.14RC0

2.5.14RC1

2.5.15RC0

2.5.1RC0

2.5.1RC1

2.5.2RC0

2.5.3RC0

2.5.3RC1

2.5.3RC2

2.5.4RC0

2.5.5

2.5.5RC0

2.5.6RC0

2.5.7RC0

2.5.8RC0

2.5.9RC0

2.6.0RC4

2.6.1RC0

2.6.1RC1

2.6.2RC0

2.6.2RC1

2.6.3RC0

2.6.3RC1

2.6.3RC2

2.6.4RC0

2.6.4RC1

2.6.5RC0

2.6.5RC1

2.6.6RC0

rel/2.*

rel/2.0.0-alpha-1

rel/2.0.0-alpha-2

rel/2.0.0-alpha-3

rel/2.0.0-beta-1

rel/2.0.0-beta-2

rel/2.5.0

rel/2.5.1

rel/2.5.10

rel/2.5.11

rel/2.5.12

rel/2.5.13

rel/2.5.14

rel/2.5.2

rel/2.5.3

rel/2.5.4

rel/2.5.5

rel/2.5.6

rel/2.5.7

rel/2.5.8

rel/2.5.9

rel/2.6.0

rel/2.6.1

rel/2.6.2

rel/2.6.3

rel/2.6.4

rel/2.6.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49326.json"