CVE-2018-8025: Vulnerability in org.apache.hbase:hbase-thrift
Summary
CVE-2018-8025: Race condition in org.apache.hbase:hbase-thrift. Affects org.apache.hbase:hbase-thrift across 4 version ranges.
< 1.2.6.1
>= 1.3.0, < 1.3.2.1
>= 1.4.0, < 1.4.5
>= 2.0.0, < 2.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.apache.hbase:hbase-thrift package is a component of Apache HBase, a distributed, scalable, and consistent NoSQL database built on top of Apache Hadoop. It provides a Thrift API server that allows clients to interact with HBase using the Thrift protocol. The Thrift 1 API server, when running over HTTP, is affected by a high severity vulnerability.
Vulnerability Detail
The vulnerability in the Thrift 1 API server of Apache HBase is due to a race-condition that can lead to authenticated sessions being incorrectly applied to users. This means that one authenticated user could be considered a different user, or an unauthenticated user could be treated as an authenticated user. This can result in unauthorized access to sensitive data or actions within the HBase system. The issue has been fixed in versions 1.2.6.1, 1.3.2.1, 1.4.5, and 2.0.1 of Apache HBase.
How To Fix
Latest published version: 3.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.6.11.2.6.1 -
>= 1.3.0, < 1.3.2.11.3.2.1 -
>= 1.4.0, < 1.4.51.4.5 -
>= 2.0.0, < 2.0.12.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of Apache HBase to mitigate the risk.
Conclusion
The vulnerability in org.apache.hbase:hbase-thrift can lead to unauthorized access to sensitive data or actions within the Apache HBase system. It is crucial to upgrade to one of the fixed versions (1.2.6.1, 1.3.2.1, 1.4.5, or 2.0.1) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hbase:hbase-thrift →
FAQ
Apache HBase is a distributed, scalable, and consistent NoSQL database built on top of Apache Hadoop. It provides random, real-time read/write access to large amounts of structured data.
The Thrift API server in Apache HBase allows clients to interact with HBase using the Thrift protocol. It provides a remote procedure call (RPC) interface for accessing HBase functionality.
The vulnerability can result in authenticated sessions being incorrectly applied to users, leading to unauthorized access to sensitive data or actions within the HBase system.
To fix this vulnerability, it is recommended to upgrade to one of the fixed versions of Apache HBase: 1.2.6.1, 1.3.2.1, 1.4.5, or 2.0.1.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of Apache HBase.
