CVE-2021-3167
6.5 MEDIUMIn Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs
Published: 2021-03-15 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CWE
- CWE-532
Affected products
| Vendor | Product |
|---|---|
| cloudera | data_engineering |
Description
In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3167
- [Vendor advisory]https://docs.cloudera.com/data-engineering/cloud/release-notes/topics/cde-general-known-issues.html
- [Vendor advisory]https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
- [Vendor advisory]https://my.cloudera.com/knowledge/TSB-2021-466-CDE-authentication-tokens-exposed-in-pod-and?id=310163
- [Vendor advisory]https://docs.cloudera.com/data-engineering/cloud/release-notes/topics/cde-general-known-issues.html
- [Vendor advisory]https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
- [Vendor advisory]https://my.cloudera.com/knowledge/TSB-2021-466-CDE-authentication-tokens-exposed-in-pod-and?id=310163
Related CVEs
Same CWE
- CVE-2025-46313 — A logging issue was addressed with improved data redaction (5.5 MEDIUM)
- CVE-2026-0267 — An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured p...
- CVE-2026-9751 — The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in p... (5.5 MEDIUM)
- CVE-2026-9735 — MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication (5.5 MEDIUM)
- CVE-2026-45581 — fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs (5.5 MEDIUM)