Read the docs
TI-2016-05848 Aliases CVE-2016-6807GHSA-j76q-99x2-v7vq

Improper access control in Apache Ambari

Priority MEDIUM 47CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.

Why it matters now

EPSS 0.02446 84th percentileScored 2026-11-07
Fix Fixed Apache Ambari (Apache Software Foundation): 2.4.2org.apache.ambari:ambari (Maven): 2.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ambari2.4 to before 2.4.22.4.2Patch availableCNA
—org.apache.ambari:ambari (Maven)2.4.0 to before 2.4.22.4.2Patch availableGHSA-j76q-99x2-v7vq
  • Apache Ambari VendorApache Affected 2.4 to before 2.4.2 Fixed in 2.4.2 Patch available CNA
  • org.apache.ambari:ambari (Maven) Vendor— Affected 2.4.0 to before 2.4.2 Fixed in 2.4.2 Patch available GHSA-j76q-99x2-v7vq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:ambari:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableApache
cpe:2.3:a:apache:ambari:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableApache
  • cpe:2.3:a:apache:ambari:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:ambari:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Ambari (Apache Software Foundation) Fixed in 2.4.2
  • Fix · GHSA-j76q-99x2-v7vq org.apache.ambari:ambari (Maven) Fixed in 2.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6807
  2. 2026-10-03 Alias added: GHSA-j76q-99x2-v7vq

References

Advisory 2

Other 2

  • TI-2017-03642 During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. CVSS 3.0CRITICAL 9.8
  • TI-2014-02906 In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on… CVSS 3.0CRITICAL 9.8
  • TI-2025-16981 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition CVSS 3.1HIGH 8.8
  • TI-2024-34845 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts CVSS 3.1HIGH 8.8
  • TI-2023-27565 Apache Ambari: authenticated users could perform command injection to perform RCE CVSS 3.1HIGH 8.8
  • TI-2022-22657 Apache Ambari: Allows authenticated metrics consumers to perform RCE CVSS 3.1HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences