{"id":"CVE-2018-8029","aliases":["EUVD-2019-0447","GHSA-37pw-qw47-4jxm"],"status":"published","title":"Privilege escalation vulnerability in Apache Hadoop","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03909,"percentile":0.9036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2019-05-30T15:15:42Z","modified":"2026-10-24T10:30:28Z","fixes":[{"ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","fixed_in":["2.8.4","2.9.2","3.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.8.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.8.4"}]}],"versions":["2.2.0","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.8.0","2.8.1","2.8.2","2.8.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}],"versions":["2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0"]}],"products":[{"vendor":"apache","product":"hadoop"},{"vendor":"apache software foundation","product":"apache hadoop"}],"references":[{"url":"https://lists.apache.org/thread.html/17084c09e6dedf60efe08028b429c92ffd28aacc28454e4fa924578a%40%3Cgeneral.hadoop.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/a97c53a81e639ca2fc7b8f61a4fcd1842c2a78544041244a7c624727%40%3Cissues.hbase.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/108518","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/a0164b87660223a2d491f83c88f905fe1a9fa8dc795148d9b0d968c8%40%3Cdev.hbase.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/0b8d58e02dbd0fb8bf7320c514fe58da1d6728bdc150f1ba04e0d9fc%40%3Cissues.hbase.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190617-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8029","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/17084c09e6dedf60efe08028b429c92ffd28aacc28454e4fa924578a@%3Cgeneral.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/0b8d58e02dbd0fb8bf7320c514fe58da1d6728bdc150f1ba04e0d9fc@%3Cissues.hbase.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/a0164b87660223a2d491f83c88f905fe1a9fa8dc795148d9b0d968c8@%3Cdev.hbase.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/a97c53a81e639ca2fc7b8f61a4fcd1842c2a78544041244a7c624727@%3Cissues.hbase.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-37pw-qw47-4jxm"},{"url":"https://security.netapp.com/advisory/ntap-20190617-0001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-8029","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","status":"published","published":"2019-05-30T15:15:42Z","modified":"2024-08-05T06:46:12.161Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2019-0447","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","status":"published","published":"2019-05-30T15:15:42Z","modified":"2024-08-05T06:46:12Z","updated_at":"2026-11-03T02:40:04.215722Z"}],"ghsa":[{"id":"GHSA-37pw-qw47-4jxm","title":"Privilege escalation vulnerability in Apache Hadoop","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","status":"published","published":"2019-05-31T16:09:15Z","modified":"2023-01-09T05:01:21Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"nvd":[{"id":"CVE-2018-8029","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","status":"published","published":"2019-05-30T16:29:01.37Z","modified":"2026-06-17T02:04:07.567Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"CVE-2018-8029","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","status":"published","published":"2019-05-30T16:29:01.37Z","modified":"2026-10-24T10:30:28.893953851Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-37pw-qw47-4jxm","title":"Privilege escalation vulnerability in Apache Hadoop","description":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.","status":"published","published":"2019-05-31T16:09:15Z","modified":"2024-02-16T08:05:28.334834Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}