Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited. Customer action: Required.
Details
What privileges an attacker could gain with a successful exploitation?
An attacker with the Service Operator role in Azure HDInsight Ambari can exploit a command injection flaw in the HDFS REBALANCEHDFS custom command to execute arbitrary system commands as the hdfs user on the NameNode.
What action should customers take to address this vulnerability?
Customers should recreate affected Azure HDInsight clusters so they are provisioned with the updated image. The fix is included in the June 29, 2026 Azure HDInsight release, image 2606012120, and later images. For instructions, see Set up clusters in HDInsight with Hadoop, Spark, and Kafka.
Security updates
2606012120 — https://learn.microsoft.com/en-us/azure/hdinsight/hdinsight-release-notes
Vulnerabilities 1
-
High 7.2
Azure HDInsight Ambari Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-81349 Azure HDInsight Ambari Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81349
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss