CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of an encryption zone key and network access to the Key Trustee KMS to make those calls against known encryption zone keys. This can result in the recovery of a previously deleted, but not purged, key (undelete) or the deletion of a key in active use (purge) resulting in loss of access to encrypted HDFS data.

• CWE-310

• https://www.cloudera.comVendor Advisory
• https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.htmlMitigation, Vendor Advisory
• https://www.cloudera.comVendor Advisory
• https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.htmlMitigation, Vendor Advisory

Published

Jun 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6178Eliding from the wrong side in an infobar in DevTools in Goo…
• CVE-2018-6179Insufficient enforcement of file access permission in the ac…
• CVE-2018-6180A flaw in the profile section of Online Voting System 1.0 al…9.8
• CVE-2018-6182Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.…
• CVE-2018-6183BitDefender Total Security 2018 allows local users to gain p…
• CVE-2018-6184ZEIT Next.js 4 before 4.2.3 has Directory Traversal under th…
• CVE-2018-6186Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF …
• CVE-2018-6187In Artifex MuPDF 1.12.0, there is a heap-based buffer overfl…
• CVE-2018-6188django.contrib.auth.forms.AuthenticationForm in Django 2.0 b…
• CVE-2018-6189F-Secure Radar (on-premises) before 2018-02-15 has XSS via v…
• CVE-2018-6190Netis WF2419 V3.2.41381 devices allow XSS via the Descriptio…
• CVE-2018-6191The js_strtod function in jsdtoa.c in Artifex MuJS through 1…