High
Security advisory
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-8029
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:26 UTC · Revision 1
Source evidence
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
osv:CVE-2018-8029
Complete source record
{
"id": "8f23a646003d558b3349921bf1562c0c61f658421777001b3fea6232d80e5c6c",
"url": "https://osv.dev/vulnerability/CVE-2018-8029",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-8029",
"summary": "In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.",
"evidence": "osv:CVE-2018-8029",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-8029",
"aliases": [
"CVE-2018-8029",
"GHSA-37pw-qw47-4jxm"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/hadoop",
"type": "GIT",
"events": [
{
"introduced": "c40e9eb30aa4bf8f3c3eb7c139a06c665417b8c6"
},
{
"last_affected": "17e75c2a11685af3e043aa5e604dc831e5b14674"
},
{
"introduced": "496dc57cc2e4f4da117f7a8e3840aaeac0c1d2d0"
},
{
"last_affected": "16b70619a24cdcf5d3b0fcf4b58ca77238ccbe6d"
},
{
"introduced": "756ebc8394e473ac25feac05fa493f6d612e6c50"
},
{
"last_affected": "1002c582d86ae8689c497c3d31b73f1ab92d5e29"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"last_affected": "2.8.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.1"
},
{
"last_affected": "3.1.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.9.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.9.0"
},
{
"last_affected": "2.9.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.9.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.9.1"
},
{
"last_affected": "2.9.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-NA"
},
{
"last_affected": "3.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha1"
},
{
"last_affected": "3.0.0-alpha1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha2"
},
{
"last_affected": "3.0.0-alpha2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha3"
},
{
"last_affected": "3.0.0-alpha3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha4"
},
{
"last_affected": "3.0.0-alpha4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta1"
},
{
"last_affected": "3.0.0-beta1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.9.0",
"2.9.1",
"3.0.0-NA",
"3.0.0-alpha1",
"3.0.0-alpha2",
"3.0.0-alpha3",
"3.0.0-alpha4",
"3.0.0-beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8029.json"
}
}
],
"modified": "2026-10-24T10:30:28.893953851Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/0b8d58e02dbd0fb8bf7320c514fe58da1d6728bdc150f1ba04e0d9fc%40%3Cissues.hbase.apache.org%3E",
"https://lists.apache.org/thread.html/17084c09e6dedf60efe08028b429c92ffd28aacc28454e4fa924578a%40%3Cgeneral.hadoop.apache.org%3E",
"https://lists.apache.org/thread.html/a0164b87660223a2d491f83c88f905fe1a9fa8dc795148d9b0d968c8%40%3Cdev.hbase.apache.org%3E",
"https://lists.apache.org/thread.html/a97c53a81e639ca2fc7b8f61a4fcd1842c2a78544041244a7c624727%40%3Cissues.hbase.apache.org%3E",
"https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E",
"https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20190617-0001/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-8029",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432161,
"published_at": "2019-05-30T16:29:01.37+00:00"
}