Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-9492

30
FAUCET Score

CVE-2020-9492 describes a critical vulnerability in Apache Hadoop versions 2.0.0-alpha through 3.2.1, where the WebHDFS client could improperly send SPNEGO authorization headers to unverified remote URLs. This flaw carries a high CVSS score of 8.8, indicating a network-exploitable vulnerability with low attack complexity that could lead to complete compromise of confidentiality, integrity, and availability. While the vulnerability is severe and affects various Apache and Oracle products, there is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding it.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.0.0, <= 2.10.0CPE matchmatch criteria
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
>= 3.0.0, <= 3.1.3CPE matchmatch criteria
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
>= 3.2.0, <= 3.2.1CPE matchmatch criteria
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
8.6.0CPE matchmatch criteria
cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:*
8.6.2CPE matchmatch criteria
cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.40%
Probability of exploitation in next 30 days
EPSS Percentile
90.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0440 is in the 90th percentile among its peer group of 17,822 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (10)

mavenpatch availablevia ghsa
Product: org.apache.hadoop:hadoop-commonFixed in: 2.10.1
mavenpatch availablevia ghsa
Product: org.apache.hadoop:hadoop-commonFixed in: 3.2.2
mavenpatch availablevia ghsa
Product: org.apache.hadoop:hadoop-commonFixed in: 3.1.4
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: RHINT Camel-Q 2.7
View patch
redhatpatch availablevia redhat_api
Product: RHAF Camel-K 1.8Fixed in: hadoop-hdfs-client
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: hadoop-hdfs-client
redhatno patchvia redhat_api
Product: Red Hat Integration Camel Quarkus 1Fixed in: hadoop-hdfs-client
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-metering-hadoop
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-metering-hive

Vendor Advisories (2)

mavenGHSA-f8vc-wfc8-hxqhhigh

Improper Privilege Management in Apache Hadoop

Feb 9, 2022
redhatCVE-2020-9492Important

hadoop: WebHDFS client might send SPNEGO authorization header

Jan 26, 2021

References

lists.apache.org / thread.html/r0a534f1cde7555f7208e9f9b791c1ab396d215eaaef283b3a9153429%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/r49c9ab444ab1107c6a8be8a0d66602dec32a16d96c2631fec8d309fb%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/r4a57de5215494c35c8304cf114be75d42df7abc6c0c54bf163c3e370%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/r513758942356ccd0d14538ba18a09903fc72716d74be1cb727ea91ff%40%3Cgeneral.hadoop.apache.org%3E
Mailing ListVendor Advisory
lists.apache.org / thread.html/r6341f2a468ced8872a71997aa1786ce036242413484f0fa68dc9ca02%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/r6c2fa7949738e9d39606f1d7cd890c93a2633e3357c9aeaf886ea9a6%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/r79201a209df9a4e7f761e537434131b4e39eabec4369a7d668904df4%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/r79323adac584edab99fd5e4b52a013844b784a5d4b600da0662b33d6%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/r9328eb49305e4cacc80e182bfd8a2efd8e640d940e24f5bfd7d5cb26%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/r941e9be04efe0f455d20aeac88516c0848decd7e7b1d93d5687060f4%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/rb12afaa421d483863c4175e42e5dbd0673917a3cff73f3fca4f8275f%40%3Cissues.solr.apache.org%3E
lists.apache.org / thread.html/rc0057ebf32b646ab47f7f5744a8948332e015c39044cbb9d87ea76cd%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/rca4516b00b55b347905df45e5d0432186248223f30497db87aba8710%40%3Cannounce.apache.org%3E
lists.apache.org / thread.html/re4129c6b9e0410848bbd3761187ce9c19bc1cd491037b253007df99e%40%3Cissues.solr.apache.org%3E
security.netapp.com / advisory/ntap-20210304-0001
Third Party Advisory
oracle.com / security-alerts/cpujul2022.html
PatchThird Party Advisory