CVE-2021-41532: Apache Ozone

Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days.

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.

Affected products

• Apache Ozone: before 1.2.0 (fixed in 1.2.0)

Published 2021-11-19. Last modified 2026-06-17.