What is the CVSS score of CVE-2026-50622?

CVE-2026-50622 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Atlas are affected by CVE-2026-50622?

Apache Atlas 0.8.0 through 2.5.0 contains a missing authorization flaw allowing any authenticated user to execute unrestricted administrative operations, breaking role-based access controls across 15…

How to fix or mitigate CVE-2026-50622?

Within 24 hours: Identify all Apache Atlas deployments and document current versions; pull authentication logs for the past 90 days to identify credential usage patterns and anomalies in admin endpoint access. Within 7 days: Implement network segmentation restricting Atlas admin REST endpoints to a bastion host or privileged access workstation; deploy a reverse proxy or API gateway in front of Atlas to enforce role-based authorization checks at the perimeter; disable admin REST endpoints entirely if not required for operational use. Within 30 days: Audit all service account credentials with Atlas access and rotate those with excessive privileges; establish continuous monitoring and alerting on admin endpoint activity; develop and test an upgrade strategy for all affected Atlas instances, prioritizing environments handling sensitive data.

Apache Atlas CVE-2026-50622

EUVD-2026-50237 HIGH

Missing Authorization (CWE-862)

2026-07-29

GHSA-w667-wgvw-q2hc

Authentication Bypass Apache Atlas

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible REST API (AV:N, AC:L); requires any valid authentication (PR:L); admin operations enable full data modification and potential service disruption (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 08:20 vuln.today

CVE Published

Jul 29, 2026 - 06:55 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Authorization Bypass in Apache Atlas 2.5.0 - CVE-2026-50622 Jul 29, 2026

AnalysisAI

Missing authorization on admin REST endpoints in Apache Atlas 0.8.0 through 2.5.0 allows any authenticated user - regardless of assigned role - to perform privileged administrative operations that should be restricted to administrators. The flaw spans 15 release versions across a multi-year window, affecting all standard deployments of the atlas-webapp component. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the low exploitation complexity (any valid credential suffices) makes this a meaningful insider and credential-compromise threat in enterprise data governance environments.

Technical ContextAI

Apache Atlas is an Apache Software Foundation metadata governance and data cataloging framework widely deployed in enterprise Hadoop and data lake architectures for lineage tracking, classification, and policy enforcement. The vulnerability resides in the atlas-webapp component (Maven artifact org.apache.atlas:atlas-webapp) and is classifiable as CWE-862 (Missing Authorization) - a server-side access control failure in which the application correctly authenticates the user but omits role or permission verification before processing requests to admin-tier API endpoints. The root cause is the absence of authorization enforcement at the controller or filter layer for the admin endpoint surface, meaning the application's role model (e.g., Atlas admin vs. data steward vs. read-only user) is not consulted when routing these requests. No CPE string or CWE identifier was supplied in the input data, but the affected artifact coordinates (org.apache.atlas:atlas-webapp, versions 0.8 through 2.5.0) precisely bound the vulnerable component.

RemediationAI

Upgrade to Apache Atlas 2.6.0, which the Apache Atlas project confirms resolves the missing authorization checks on admin endpoints; this is the primary and recommended remediation per the vendor advisory at https://atlas.apache.org/ and the oss-security notice at https://seclists.org/oss-sec/2026/q3/316. Until upgrade is feasible, apply network-layer compensating controls: restrict access to Atlas admin API endpoint paths (e.g., /api/atlas/admin/*) via a reverse proxy, WAF rule set, or network ACL so that only known administrator source IPs or service accounts can reach them. Additionally, audit current Atlas user accounts and disable or restrict any service accounts with broader-than-necessary access. Note that network-layer controls do not fix the underlying authorization bypass and will not protect against threats originating from within the permitted network segment; upgrade to 2.6.0 remains the only confirmed fix.