Read the docs
TI-2019-00185 Aliases CVE-2019-0212GHSA-535v-4x9q-446c

Improper authorization in Apache HBase

Priority LOW 39CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-285.

Summary

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

Why it matters now

EPSS 0.03782 90th percentileScored 2026-11-07
Fix Partial org.apache.hbase:hbase (Maven): 2.0.5, 2.1.4Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HBaseApache HBase 2.0.0-2.0.4; 2.1.0-2.1.3—No fix listedCNA
—org.apache.hbase:hbase (Maven)2.0.0 to before 2.0.52.0.5Patch availableGHSA-535v-4x9q-446c
—org.apache.hbase:hbase (Maven)2.1.0 to before 2.1.42.1.4Patch availableGHSA-535v-4x9q-446c
  • Apache HBase VendorApache Affected Apache HBase 2.0.0-2.0.4; 2.1.0-2.1.3 Fixed in — No fix listed CNA
  • org.apache.hbase:hbase (Maven) Vendor— Affected 2.0.0 to before 2.0.5 Fixed in 2.0.5 Patch available GHSA-535v-4x9q-446c
  • org.apache.hbase:hbase (Maven) Vendor— Affected 2.1.0 to before 2.1.4 Fixed in 2.1.4 Patch available GHSA-535v-4x9q-446c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:*2.0.0 – 2.0.4; 2.1.0 – 2.1.3VulnerableApache
  • cpe:2.3:a:apache:hbase:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.0.4; 2.1.0 – 2.1.3 Vulnerable ·Apache

Remediation

  • Fix · GHSA-535v-4x9q-446c org.apache.hbase:hbase (Maven) Fixed in 2.0.5 Advisory →
  • Fix · GHSA-535v-4x9q-446c org.apache.hbase:hbase (Maven) Fixed in 2.1.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0212
  2. 2026-10-03 Alias added: GHSA-535v-4x9q-446c
  3. 2026-11-06 EPSS moved to the 90th–95th percentile

References

Advisory 3

Other 6

  • TI-2015-01649 Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used… CVSS 3.0HIGH 7.3
  • TI-2019-11644 An issue was discovered in the protobuf crate before 2.6.0 for Rust. CVSS 3.1HIGH 7.5
  • TI-2018-05802 Race condition in Apache HBase CVSS 3.0HIGH 8.1
  • TI-2026-36509 Apache HBase: Missing scanner instance owner check in thrift delegation service CVSS 3.1MEDIUM 6.5
  • TI-2013-01959 Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences