What’s Vulnerable › Vulnerabilities

CVE-2021-33036: Apache Hadoop Privilege escalation vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-15 · updated 2026-06-17
• Weakness: CWE-24

Description

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

Affected products

• Apache Software Foundation Apache Hadoop: from 2.2.0 before 2.10.2; from 3.0.1 before 3.2.3; from 3.3.0 before 3.3.2; 3.0.0-alpha1, 3.0.0-alpha2, 3.0.0-alpha3, 3.0.0-alpha4 — fixed in 2.10.2, 3.2.3, 3.3.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Hadoop 2.10.2, 3.2.3, 3.3.2. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/06/15/2
• https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5
• https://security.netapp.com/advisory/ntap-20220722-0003/
• http://www.openwall.com/lists/oss-security/2022/06/15/2
• https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5
• https://security.netapp.com/advisory/ntap-20220722-0003/

Get alerted when CVE-2021-33036 or the next vulnerability affects your stack