What’s Vulnerable › Vulnerabilities

CVE-2021-25642: Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-25 · updated 2026-06-17
• Weakness: CWE-502

Description

ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.

Affected products

• Apache Software Foundation Apache Hadoop: from 2.9.0 before 2.10.2; from 3.0.0 before 3.2.4; from 3.3.0 before 3.3.4 — fixed in 2.10.2, 3.2.4, 3.3.4

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Hadoop 2.10.2, 3.2.4, 3.3.4. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150
• https://security.netapp.com/advisory/ntap-20221201-0003/
• https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150
• https://security.netapp.com/advisory/ntap-20221201-0003/

Get alerted when CVE-2021-25642 or the next vulnerability affects your stack