CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Medium 6.5 Published 24 Jul 2026 Updated 24 Jul 2026

Attackers can read data from or close scanners opened by other users due to missing owner checks in HBase thrift/rest services.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-49326?

CVE-2026-49326 is a medium-severity missing authorization vulnerability in Apache HBase, published on 24 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.

A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.

This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.

Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.

Weakness: CWE-862

Which versions are affected by CVE-2026-49326?

It affects 1 product.

Products include Apache Hbase.

How do I fix CVE-2026-49326?

No fix has been published for CVE-2026-49326 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-49326 being exploited?

There is no known exploitation of CVE-2026-49326 in the wild and no public exploit code.

Sources

Also known as GHSA-4hqf-vmxx-hj9h.