Read the docs
TI-2018-08421 Aliases CVE-2018-11764GHSA-4fh8-pm7g-pmxq

Missing authentication in Apache Hadoop

Priority MEDIUM 43CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-306.

Summary

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.

Why it matters now

EPSS 0.02394 84th percentileScored 2026-11-07
Fix Partial org.apache.hadoop:hadoop-main (Maven): 3.0.1Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache HadoopApache Hadoop 3.0.0-alpha4, 3.0.0-beta1, 3.0.0—No fix listedCNA
—org.apache.hadoop:hadoop-main (Maven)3.0.0-alpha4 to before 3.0.13.0.1Patch availableGHSA-4fh8-pm7g-pmxq
—org.apache.hadoop:hadoop-main (Maven)3.0.0-beta1 to before 3.0.13.0.1Patch availableGHSA-4fh8-pm7g-pmxq
—org.apache.hadoop:hadoop-main (Maven)3.0.0 to before 3.0.13.0.1Patch availableGHSA-4fh8-pm7g-pmxq
  • Apache Hadoop Vendor— Affected Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, 3.0.0 Fixed in — No fix listed CNA
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 3.0.0-alpha4 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-4fh8-pm7g-pmxq
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 3.0.0-beta1 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-4fh8-pm7g-pmxq
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-4fh8-pm7g-pmxq

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*3.0.0VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*3.0.0 alpha4VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:*3.0.0 beta1VulnerableApache
  • cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-4fh8-pm7g-pmxq org.apache.hadoop:hadoop-main (Maven) Fixed in 3.0.1 Advisory →
  • Fix · GHSA-4fh8-pm7g-pmxq org.apache.hadoop:hadoop-main (Maven) Fixed in 3.0.1 Advisory →
  • Fix · GHSA-4fh8-pm7g-pmxq org.apache.hadoop:hadoop-main (Maven) Fixed in 3.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Not affected: 5 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11764
  2. 2026-10-03 Alias added: GHSA-4fh8-pm7g-pmxq

References

Advisory 3

Other 1

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2022-09898 Arbitrary file write in FileUtil#unpackEntries on Windows CVSS 3.1CRITICAL 9.8
  • TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
  • TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
  • TI-2018-05786 Path traversal in Apache Hadoop CVSS 3.0HIGH 8.8
  • TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences