Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Apache Ozone versions 1.4.0 (org.apache.ozone:ozone, fixed in 1.4.1) have an authentication flaw in the S3 Gateway's HTTP endpoint for secrets. Any authenticated Kerberos user can revoke and regenerate the S3 secrets of other users, but only when ozone.s3g.secret.http.enabled is set to true (the default is false) and the S3 Gateway principal is also an S3 or Ozone administrator. Upgrade to Apache Ozone 1.4.1, which disables the affected endpoint.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.1 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.0058, the 48th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:12 UTC First seen by agentprime
- 31 Oct 2026, 15:12 UTC Confirmed by OSV