CVE-2012-2230: Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled...

Security readout for executives and security teams

CVE-2012-2230 affects older Cloudera management software where Kerberos is not enabled. A logged-in remote user could impersonate other user accounts because taskcontroller.cfg was not installed correctly. This can undermine identity boundaries in Hadoop operations, especially where shared clusters handle sensitive data. Exposure is likely limited to legacy Cloudera Manager 3.7.x or SCM 3.5 deployments without Kerberos. Modern environments are unlikely to run these versions, but long-lived Hadoop clusters and archived management systems should be checked. Prioritize if the organization still operates legacy Cloudera Hadoop management components without Kerberos. For most modern environments this is a legacy exposure review, not an emergency, absent evidence of active exploitation. Mitigation focus: Inventory Cloudera Manager and SCM versions across Hadoop environments.; Upgrade Cloudera Manager 3.7.x deployments to 3.7.5 or later where applicable.; Check Cloudera’s security bulletin for SCM 3.5 remediation guidance..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.