Apache Knox allows impersonation of users
Published May 26, 2017 · Updated Oct 23, 2026 · Also known as GHSA-g3fc-8jv4-qmmv
Original summary
Normalized public record · Updated Oct 23, 2026
Apache Knox allows impersonation of users
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be easily associated with the authenticated user, this is still a serious security issue. All users are recommended to upgrade to the Apache Knox 0.12.0 release.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- GHSA-g3fc-8jv4-qmmv
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- [knox-user] 20170526 [ANNOUNCE] CVE-2017-5646: Apache Knox Impersonation Issue for WebHDFS ↗
- 98739 ↗
- [logging-dev] 20201107 Re: Chainsaw update ↗
Record history
Published May 26, 2017 · Last refreshed Oct 23, 2026