Executive brief
Apache Atlas, a scalable metadata management and governance service, contains a security flaw in its administrative interface. This vulnerability allows any user who is logged into the system to perform administrative tasks, even if they do not have the proper permissions. An attacker could use this to modify system settings or perform unauthorized operations, potentially compromising the integrity of the data governance platform.
Technical details
A missing authorization vulnerability (CWE-862) exists in the administrative endpoints of Apache Atlas. The flaw resides in the 'atlas-webapp' component where role-based access control (RBAC) is not properly enforced for sensitive administrative operations. An authenticated attacker, regardless of their specific role or privileges, can access and execute functions on admin endpoints by sending direct network requests. This allows for unauthorized configuration changes or administrative actions. The issue affects versions 0.8 through 2.5.0 and is resolved in version 2.6.0.
Affected products
- Apache Software Foundation Apache Atlas 0.8 through 2.5.0
Timeline
- 2026-07-29: advisory: NVD publication date
- 2026-07-29: patched: Version 2.6.0 released to address the issue