CVE-2019-0212

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

• http://www.openwall.com/lists/oss-security/2019/03/27/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107624Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E
• https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
• http://www.openwall.com/lists/oss-security/2019/03/27/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107624Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E
• https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Published

Mar 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-0206Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0207Tapestry processes assets `/assets/ctx` using classes chain …7.5
• CVE-2019-0208Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0209Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0210In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go…7.5
• CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MP…7.8
• CVE-2019-0213In Apache Archiva before 2.2.4, it may be possible to store …
• CVE-2019-0214In Apache Archiva 2.0.0 - 2.2.3, it is possible to write fil…
• CVE-2019-0215In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug …
• CVE-2019-0216A malicious admin user could edit the state of objects in th…
• CVE-2019-0217In Apache HTTP Server 2.4 release 2.4.38 and prior, a race c…7.5
• CVE-2019-0218A vulnerability was discovered wherein a specially crafted U…