CVE-2016-3086

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
Apache Software FoundationApache Hadoop2.6.0 to 2.6.4; 2.7.0 to 2.7.2

References

Timeline

Published
Sep 5, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-30879.8Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackerCVE-2016-30889.8The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTCVE-2016-30896.1Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary weCVE-2016-30908.8The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a craftCVE-2016-30917.5Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.CVE-2016-30927.5The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x beCVE-2016-30935.3Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackCVE-2016-30945.9PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers tCVE-2016-30955.5server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.CVE-2016-30967.8The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitCVE-2016-30976.1Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script oCVE-2016-30985.4Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autoriz
CVE-2016-3086: Critical severity, CVSS 9.8 | Vulnix