GHSA-895m-ww55-59vw
GitHub Security Advisory
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
✓ GitHub Reviewed
CRITICAL
Has CVE
Advisory Details
The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Affected Packages
Maven
org.apache.hadoop:hadoop-yarn-server-nodemanager
Affected versions:
2.6.0
(fixed in 2.6.5)
Maven
org.apache.hadoop:hadoop-yarn-server-nodemanager
Affected versions:
2.7.0
(fixed in 2.7.3)
Related CVEs
Key Information
9.0
/10
Dataset
Last updated: July 28, 2025 6:37 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.