Is CVE-2018-6185 actively exploited?

No active exploitation of CVE-2018-6185 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2018-6185 be exploited remotely?

Yes. CVE-2018-6185 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2018-6185?

CVE-2018-6185 has a CVSS score of 4.9 (MEDIUM).

HOME VULNERABILITIESCVE-2018-6185

MEDIUM

CVE-2018-6185

CWE-310Published: June 7, 2019· Updated: Jun 17, 2026

4.9

CVSS v3.1

Official Description

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of an encryption zone key and network access to the Key Trustee KMS to make those calls against known encryption zone keys. This can result in the recovery of a previously deleted, but not purged, key (undelete) or the deletion of a key in active use (purge) resulting in loss of access to encrypted HDFS data.

NVD Source

Technical Analysis

CVE-2018-6185 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 4.9.