CVE-2021-25642

HIGH

Apache Hadoop 2.9.0-2.10.1 - Remote Code Execution via ZKConfigurationStore Deserialization

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-25642. PoCs published by safe3s.

AI-analyzed exploit summary The repository contains only a minimal README with the CVE identifier and no exploit code, technical details, or functional content.

Description

ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.

Exploits (1)

nomisec STUB

by safe3s · poc

https://github.com/safe3s/CVE-2021-25642

View Code ZIP pw:eip

The repository contains only a minimal README with the CVE identifier and no exploit code, technical details, or functional content.

Classification

Stub 100%

Attack Type

Other

Complexity

Trivial

Reliability

Theoretical

Target: unknown

No auth needed

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Mailing List, Vendor Advisory

https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150

Third Party Advisory

https://security.netapp.com/advisory/ntap-20221201-0003/

Scores

CVSS v3 8.8

EPSS 0.0182

EPSS Percentile 76.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-502

Status published

Products (2)

apache/hadoop 2.9.0 - 2.10.2

org.apache.hadoop/hadoop-yarn-server 0 - 2.10.2Maven

Published Aug 25, 2022

Tracked Since Feb 18, 2026