{"id":"CVE-2018-11766","details":"In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.","aliases":["GHSA-rqj9-cq6j-958r"],"modified":"2026-07-08T17:15:01.189356Z","published":"2018-11-27T14:29:00.260Z","references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/ff37bbbe09d5f03090e2dd2c3dea95de16ef4249e731f19b8959ce4c%40%3Cgeneral.hadoop.apache.org%3E"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106035"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/hadoop","events":[{"introduced":"cd915e1e8d9d0131462a0b7301586c175728a282"},{"last_affected":"085099c66cf28be31604560c376fa282e69282b8"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.7.4"},{"last_affected":"2.7.6"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11766.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}