CVE-2018-11765: Improper Authentication in Apache Hadoop
Summary
CVE-2018-11765: Improper Authentication in Apache Hadoop. Affects org.apache.hadoop:hadoop-main across 3 version ranges.
>= 2.8.0, < 2.8.6
>= 2.9.0, < 2.9.3
>= 3.0.0-alpha2, < 3.0.1
Fixed in 2.8.6, 2.9.3 or 3.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The vulnerability identified as CVE-2018-11765 affects versions 2.8.0 to 2.8.5, 2.9.0 to 2.9.2, and 3.0.0-alpha2 to 3.0.0 of the 'org.apache.hadoop:hadoop-main' package. This vulnerability allows unauthorized users to access certain servlets without authentication when Kerberos authentication is enabled but SPNEGO through HTTP is not enabled.
Vulnerability Detail
The vulnerability arises due to the improper authentication mechanism in Apache Hadoop. When Kerberos authentication is enabled but SPNEGO through HTTP is not enabled, any user can access specific servlets without proper authentication. This can lead to unauthorized access to sensitive information or functionality within the Apache Hadoop framework. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.8.0, < 2.8.62.8.6 -
>= 2.9.0, < 2.9.32.9.3 -
>= 3.0.0-alpha2, < 3.0.13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can enable SPNEGO through HTTP to ensure proper authentication. This can be achieved by configuring the Apache Hadoop framework accordingly. However, it is strongly advised to apply the recommended fix by upgrading to the fixed versions of the package.
Conclusion
The vulnerability CVE-2018-11765 in Apache Hadoop exposes a security flaw in the authentication mechanism, allowing unauthorized access to certain servlets. It is crucial to upgrade to the fixed versions of the 'org.apache.hadoop:hadoop-main' package to ensure proper authentication and prevent potential unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
Versions 2.8.0 to 2.8.5, 2.9.0 to 2.9.2, and 3.0.0-alpha2 to 3.0.0 of the 'org.apache.hadoop:hadoop-main' package are affected.
The vulnerability allows unauthorized users to access certain servlets without authentication, potentially leading to unauthorized access to sensitive information or functionality within Apache Hadoop.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the 'org.apache.hadoop:hadoop-main' package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
