Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/apache/accumulo/issues/6478 Issue Tracking, Patch
- https://lists.apache.org/thread/qclg736k93oqn4qrpw9wxjbb3jhn6gm1 Mailing List, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.7 · apacheNVD modified 2026-10-24 20:10
Affected (CPE criteria) 1
cpe:2.3:a:apache:accumulo:*:*:*:*:*:*:*:*
References 5
- https://accumulo.apache.org/downloads/ Product
- https://accumulo.apache.org/release/accumulo-2.1.6/ Release Notes
- https://github.com/apache/accumulo/issues/6478 Issue Tracking, Patch
- https://lists.apache.org/thread/qclg736k93oqn4qrpw9wxjbb3jhn6gm1 Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/17/6 Mailing List, Third Party Advisory