{"id":"CVE-2021-33036","aliases":["EUVD-2022-5933","GHSA-58jx-f5rf-qgqf","OESA-2022-2016"],"status":"published","title":"Apache Hadoop Privilege escalation vulnerability","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04033,"percentile":0.9069,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-24","CWE-264","CWE-502"],"published":"2022-06-15T14:25:14Z","modified":"2026-10-24T14:25:12Z","fixes":[{"ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","fixed_in":["2.10.2","3.2.3","3.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"hadoop","fixed_in":["3.3.4-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"hadoop","fixed_in":["3.3.4-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"hadoop","fixed_in":["3.3.4-1.oe2203"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.10.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.10.2"}]}],"versions":["2.10.0","2.10.1","2.2.0","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.3"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-yarn-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.2"}]}],"versions":["3.3.0","3.3.1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"hadoop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"hadoop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"hadoop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-1.oe2203"}]}]}],"products":[{"vendor":"apache","product":"hadoop"},{"vendor":"apache software foundation","product":"apache hadoop"}],"references":[{"url":"https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/15/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220722-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33036","tags":["advisory"]},{"url":"https://github.com/apache/hadoop/commit/227d64ab59e8aa6477769b2542ad0cd7a6d855cb","tags":["web"]},{"url":"https://github.com/apache/hadoop/commit/45801fba8b00257ab32c02a7d1a05948ba687a49","tags":["web"]},{"url":"https://github.com/apache/hadoop/commit/ba041fe6d34215f075e0a7b2078d7273147e14b7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-58jx-f5rf-qgqf"},{"url":"https://github.com/apache/hadoop","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20220722-0003","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2016","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-33036","title":"Apache Hadoop Privilege escalation vulnerability","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","status":"published","published":"2022-06-15T14:25:14Z","modified":"2024-08-03T23:42:19.282Z","cwes":["CWE-264","CWE-24"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2022-5933","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","status":"published","published":"2022-06-15T14:25:14Z","modified":"2024-08-03T23:42:19Z","updated_at":"2026-11-03T03:24:34.73748Z"}],"ghsa":[{"id":"GHSA-58jx-f5rf-qgqf","title":"User account escalation in Apache Hadoop","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","status":"published","published":"2022-06-16T00:00:21Z","modified":"2023-01-27T05:04:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-502"],"updated_at":"2026-11-02T14:36:20.985872Z"}],"nvd":[{"id":"CVE-2021-33036","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","status":"published","published":"2022-06-15T15:15:07.973Z","modified":"2026-06-17T03:54:03.157Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-24","CWE-264","CWE-22"],"updated_at":"2026-11-02T14:07:06.501652Z"}],"osv":[{"id":"CVE-2021-33036","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","status":"published","published":"2022-06-15T15:15:07.973Z","modified":"2026-10-24T14:25:12.392276364Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"GHSA-58jx-f5rf-qgqf","title":"User account escalation in Apache Hadoop","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","status":"published","published":"2022-06-16T00:00:21Z","modified":"2024-02-21T05:31:52.226908Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-502"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"OESA-2022-2016","title":"hadoop security update","description":"Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.(CVE-2021-33036)","status":"published","published":"2022-10-21T11:05:19Z","modified":"2026-08-18T01:17:20.046499267Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"}]}}