CVE-2018-8029: Privilege escalation vulnerability in Apache Hadoop
Summary
CVE-2018-8029: Privilege escalation vulnerability in Apache Hadoop. Affects org.apache.hadoop:hadoop-main across 3 version ranges.
>= 2.2.0, < 2.8.4
>= 2.9.0, < 2.9.2
>= 3.0.0, < 3.1.1
Fixed in 2.8.4, 2.9.2 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The vulnerability in Apache Hadoop versions 2.2.0 to 2.8.4, 2.9.0 to 2.9.1, and 3.0.0-alpha1 to 3.1.0 allows a user with the ability to escalate to the yarn user to potentially execute arbitrary commands as the root user.
Vulnerability Detail
The privilege escalation vulnerability in Apache Hadoop arises from a flaw that allows an attacker to run arbitrary commands as the root user. This can be exploited by a user who has the capability to escalate to the yarn user. By leveraging this vulnerability, an attacker can gain unauthorized access and perform malicious activities on the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.8.42.8.4 -
>= 2.9.0, < 2.9.22.9.2 -
>= 3.0.0, < 3.1.13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the necessary updates as mentioned in the 'how_to_fix' section.
Conclusion
The privilege escalation vulnerability in Apache Hadoop can allow unauthorized users to execute arbitrary commands as the root user, potentially leading to unauthorized access and malicious activities. It is crucial to promptly upgrade to the fixed versions of Apache Hadoop to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
The vulnerability affects Apache Hadoop versions 2.2.0 to 2.8.4, 2.9.0 to 2.9.1, and 3.0.0-alpha1 to 3.1.0.
The vulnerability allows a user with the ability to escalate to the yarn user to potentially execute arbitrary commands as the root user, leading to unauthorized access and potential malicious activities.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Hadoop as mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
