Executive brief
Apache Accumulo is a high-performance data storage and retrieval system. A security flaw allows a user with low-level access to remotely shut down critical system components, such as the manager or tablet servers. This can result in a complete service outage (Denial of Service), disrupting data operations and application availability.
Technical details
An Improper Handling of Insufficient Privileges vulnerability (CWE-274) exists in Apache Accumulo versions 2.1.4 and 2.1.5. The root cause is located in the AbstractServer class, where a missing return statement after a permission check allows unauthorized shutdown requests to proceed even if the check fails. An authenticated attacker with low privileges can remotely trigger a graceful shutdown of components including the compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver. While the server logs that the action was denied, it still honors the request and shuts down. The issue is resolved in version 2.1.6.
Affected products
- Apache Software Foundation Accumulo 2.1.4, 2.1.5
Timeline
- 2026-07-16: disclosed: Issue reported on GitHub
- 2026-07-17: advisory: Official Apache advisory and CVE published
- 2026-07-17: patched: Version 2.1.6 released