org.apache.hbase/hbase-thrift vulnerabilities

Latest org.apache.hbase/hbase-thrift CVEs

Newest publication first

1. CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

   Published 2026-07-24

   Medium·CVSS 6.5 EPSS 0.49%

   Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanne...

2. CVE-2018-8025 Race condition in org.apache.hbase:hbase-thrift

   Published 2018-06-27

   High·CVSS 8.1 EPSS 1.7%

   CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a diff...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.