CVE-2026-49326 is a missing authorization vulnerability (CWE-862) in Apache HBase's thrift and REST delegation services. The scan operation involves three steps: open, fetch, and close. While the open step returns an identifier for the scanner instance, the fetch and close steps lack verification of the scanner owner. This allows an attacker to fetch data from scanners opened by other users and close those scanners, potentially leading to unauthorized data access or disruption of scanning operations. The vulnerability affects Apache HBase versions from 3.0.0-alpha-1 through 3.0.0-beta-1, 2.6.0 through 2.6.5, 2.5.0 through 2.5.14, and all 2.4.x versions. The issue is fixed in versions 3.0.0-beta-2, 2.6.6, and 2.5.15.

The vulnerability allows unauthorized users to access data rows from scanners opened by other users and to close those scanners. This can lead to unauthorized data exposure and interference with legitimate scanning operations. No known exploits in the wild have been reported. The impact is primarily unauthorized data access and potential denial of service to scanner resources.

Users should upgrade affected Apache HBase versions to 3.0.0-beta-2, 2.6.6, or 2.5.15 or later, where the missing authorization checks have been implemented. Patch status is confirmed by the vendor advisory recommending these versions. No other mitigations are indicated.