CVE-2026-49326: Apache HBase Auth Bypass Vulnerability

CVE-2026-49326 Overview

CVE-2026-49326 is a missing authorization vulnerability in the Apache HBase thrift and rest delegation service. The scan operation exposed by these services follows a three-step lifecycle: open, fetch, and close. The open step returns a scanner identifier that clients pass back to identify server-side scanner instances. The service fails to verify scanner ownership during the fetch and close steps. An authenticated user can therefore read rows from scanners opened by other users and terminate scanners that belong to other users. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated users can read data from scanners owned by other users and disrupt legitimate scan operations by closing scanners they do not own.

Affected Products

Apache HBase 3.0.0-alpha-1 through 3.0.0-beta-1
Apache HBase 2.6.0 through 2.6.5
Apache HBase 2.5.0 through 2.5.14, and all 2.4.* releases
Apache HBase thrift and rest delegation service components

Discovery Timeline

2026-07-24 - CVE CVE-2026-49326 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-49326

Vulnerability Analysis

Apache HBase exposes scan operations through its thrift and rest delegation services. Each scan is a stateful, multi-step interaction. A client calls open to create a scanner, receives a scanner identifier, calls fetch one or more times to retrieve rows, and calls close to release resources. The server tracks scanner instances by identifier only.

The implementation records the identity of the user who created each scanner during open. However, subsequent fetch and close operations do not compare the caller's identity against the scanner owner. Any authenticated user who can guess, observe, or enumerate a valid scanner identifier can invoke fetch and close against that scanner.

This breaks the confidentiality guarantee that scan results are restricted to the requesting user. It also allows targeted disruption because closing a scanner mid-operation terminates the legitimate user's session state.

Root Cause

The root cause is a missing owner check in the request handlers for the fetch and close scanner operations in the thrift and rest delegation service. Authorization was enforced only at scanner creation and not on subsequent operations that reference an existing scanner identifier.

Attack Vector

An attacker requires network access to the HBase thrift or rest endpoint and valid credentials to authenticate to the delegation service. The attacker then submits fetch or close requests referencing a scanner identifier owned by another user. Successful exploitation returns row data from the targeted scanner or terminates that scanner.

No verified proof-of-concept code has been published. The vulnerability is described in the Apache Security Discussion Thread and the OpenWall OSS Security Update.

Detection Methods for CVE-2026-49326

Indicators of Compromise

Thrift or rest service access logs showing fetch or close requests where the authenticated principal differs from the principal that issued the preceding open call for the same scanner identifier.
Unexpected premature termination of long-running scan sessions reported by legitimate users or applications.
Rows returned to clients that do not match the row ranges those clients requested during their own open operations.

Detection Strategies

Correlate scanner lifecycle events by identifier across access logs and flag cases where the caller of fetch or close does not match the caller of the originating open.
Alert on high rates of fetch or close requests from a single principal referencing scanner identifiers not observed in that principal's open operations.
Review authorization audit logs on the HBase thrift and rest gateways for anomalous access patterns against sensitive column families.

Monitoring Recommendations

Enable verbose request logging on HBase thrift and rest delegation endpoints and forward the logs to a central analytics platform.
Baseline normal scanner usage per service account and alert on deviations in scanner identifier reuse across principals.
Monitor for authentication events from unexpected source networks against thrift and rest ports.

How to Mitigate CVE-2026-49326

Immediate Actions Required

Upgrade Apache HBase to version 3.0.0-beta-2, 2.6.6, or 2.5.15, which contain the fix.
Inventory all HBase clusters exposing thrift or rest delegation services and prioritize patching internet-adjacent deployments.
Rotate delegation tokens and credentials used with the thrift and rest services after patching.

Patch Information

Apache HBase has released fixed versions 3.0.0-beta-2, 2.6.6, and 2.5.15. The patches add the missing ownership check to the fetch and close scanner request handlers so that only the principal that opened a scanner can operate on it. Details are published in the Apache Security Discussion Thread.

Workarounds

Restrict network access to HBase thrift and rest endpoints to trusted service accounts and management networks using firewall rules or service mesh policies.
Disable the thrift and rest delegation services on clusters where they are not required.
Enforce short scanner lifetimes and short delegation token lifetimes to reduce the window in which a scanner identifier can be abused.

bash

# Configuration example: restrict HBase thrift/rest exposure at the network layer
# Replace <trusted_cidr> and interface names to match your environment.
iptables -A INPUT -p tcp --dport 9090 -s <trusted_cidr> -j ACCEPT   # thrift
iptables -A INPUT -p tcp --dport 8080 -s <trusted_cidr> -j ACCEPT   # rest
iptables -A INPUT -p tcp --dport 9090 -j DROP
iptables -A INPUT -p tcp --dport 8080 -j DROP