Apache Hbase vulnerabilities
6 CVEs affecting Apache Hbase, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49326, published 2026-07-24.
More from Apache.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2015-1836, published 2015-12-21. High severity, CVSS 7.3. EPSS: 7.4% chance of exploitation in the next 30 days. Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper…
- CVE-2019-0212, published 2019-03-28. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were…
- CVE-2019-15544, published 2019-08-26. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- CVE-2018-8025, published 2018-06-27. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being…
- CVE-2013-2193, published 2014-05-29. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive…
- CVE-2026-49326, published 2026-07-24. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open…