Improper Authentication in Apache Hadoop

published 2017-03-23 9 y ago modified 2026-06-17 4 mo ago also GHSA-9r7g-325h-mxrm , EUVD-2022-3441

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits: 0; none known

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

Patch / fix

fixed in 1

maven org.apache.hadoop:hadoop-common 0.23.11, 2.4.1

Exploit prediction

1.60% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P
GitHub	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.hadoop:hadoop-common	>=0.23.0, <0.23.11 >=2.0.0, <2.4.1	0.23.11 2.4.1

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls
CWE-287 Improper Authentication

References

cloudera.com /documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2014-0229
advisory

Sources

CVE List CVE-2014-0229
GitHub Advisory GHSA-9r7g-325h-mxrm
NVD CVE-2014-0229

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary