CVE-2026-49326

Name of the Vulnerable Software and Affected Versions Apache HBase versions 3.0.0-alpha-1 through 3.0.0-beta-1 Apache HBase versions 2.6.0 through 2.6.5 Apache HBase versions 2.5.0 through 2.5.14 Apache HBase versions prior to 2.4.1

Description An authorization flaw exists in the thrift and rest delegation services. A scan operation consists of three steps: open, fetch, and close. The open step generates an identifier used to track scanner instances on the server. Because the server fails to verify the owner during the fetch and close steps, an attacker can retrieve data from scanners opened by other users or close scanners belonging to other users.

Recommendations Upgrade versions 3.0.0-alpha-1 through 3.0.0-beta-1 to 3.0.0-beta-2. Upgrade versions 2.6.0 through 2.6.5 to 2.6.6. Upgrade versions 2.5.0 through 2.5.14 to 2.5.15.