Read the docs
TI-2016-05852 Aliases CVE-2016-6811GHSA-mf7c-35mq-75pj

In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run…

Priority MEDIUM 43CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.

Summary

In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.

Why it matters now

EPSS 0.0262 85th percentileScored 2026-11-07
Fix Partial org.apache.hadoop:hadoop-common (Maven): 2.7.4Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.hadoop:hadoop-common (Maven)2.0.0-alpha to before 2.7.42.7.4Patch availableGHSA-mf7c-35mq-75pj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 2.0.0-alpha to before 2.7.4 Fixed in 2.7.4 Patch available GHSA-mf7c-35mq-75pj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*2.2.0 – 2.7.3VulnerableApache
  • cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* Versions 2.2.0 – 2.7.3 Vulnerable ·Apache

Remediation

  • Fix · GHSA-mf7c-35mq-75pj org.apache.hadoop:hadoop-common (Maven) Fixed in 2.7.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6811
  2. 2026-10-03 Alias added: GHSA-mf7c-35mq-75pj

References

Advisory 1

Other 2

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2022-09898 Arbitrary file write in FileUtil#unpackEntries on Windows CVSS 3.1CRITICAL 9.8
  • TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
  • TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
  • TI-2018-05786 Path traversal in Apache Hadoop CVSS 3.0HIGH 8.8
  • TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences