CVE-2018-8025

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.

• CWE-362

• http://www.securityfocus.com/bid/104554Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/a919e38f587c714c386a01d40fc8f45bd4219a65aaf2dc0bb4eccc96%40%3Cdev.hbase.apache.org%3E
• http://www.securityfocus.com/bid/104554Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/a919e38f587c714c386a01d40fc8f45bd4219a65aaf2dc0bb4eccc96%40%3Cdev.hbase.apache.org%3E

Published

Jun 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8019When using an OCSP responder Apache Tomcat Native 1.2.0 to 1…
• CVE-2018-8020Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 ha…
• CVE-2018-8021Versions of Superset prior to 0.23 used an unsafe load metho…
• CVE-2018-8022A carefully crafted invalid TLS handshake can cause Apache T…
• CVE-2018-8023Apache Mesos can be configured to require authentication to …
• CVE-2018-8024In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, i…
• CVE-2018-8026This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 t…
• CVE-2018-8027Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable …
• CVE-2018-8028An authenticated user can execute ALTER TABLE EXCHANGE PARTI…
• CVE-2018-8029In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.…
• CVE-2018-8030A Denial of Service vulnerability was found in Apache Qpid B…
• CVE-2018-8031The Apache TomEE console (tomee-webapp) has a XSS vulnerabil…