From ae3e5cde2f42ae0bbddff9b713a1da890e1bf89a Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Thu, 23 Jul 2026 13:59:17 +0000 Subject: [PATCH 1/8] Created SECURITY.md --- SECURITY.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000000..703cf5b8b54 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,56 @@ +## Reporting a vulnerability + +If after reading this document you believe you have found a vulnerability or are unsure, +then please follow the [reporting process](https://www.apache.org/security/#reporting-a-vulnerability). + +## High-Level Accumulo Deployment Overview + +Accumulo is designed to use Apache ZooKeeper for locking and coordination +and one or more Hadoop Compatible File System (HCFS) implementations +(HDFS, S3, local disk, etc.) for storage. Accumulo users could be humans +or machines connecting to Accumulo server processes from any location. +Please see the Security section of the User Manual for information +regarding: + + * User authentication + * Authorizing actions and our permission scheme + * Labeling data and scan-time authorizations + * Encryption + +## Security Assumptions + +The following items are out of our control and we assume that these items +are configured correctly and securely or are otherwise trusted. + + * Network, to include network encryption components + * DNS + * Operating Systems and related compute hardware + * ZooKeeper and HCFS storage configured for Accumulo's use + * Persons or processes that can log into an environment (bare-metal or container) + where Accumulo, ZooKeeper, or HCFS-related processes are running + * Accumulo configuration files (e.g. accumulo-env.sh, accumulo.properties, logging configuration, etc.) + * The JVM classpath for Accumulo processes (configured in accumulo-env.sh or similar mechanism) + * User provided code that runs in the server process via an Accumulo SPI + * User configured JVM agents + +## Accumulo Security Boundary and Responsibilities + +The Accumulo RPC layer, not the Accumulo client or shell, is the security boundary. Users +are not required to use the client and may interact with server processes via +supported RPC's. Security enforcement mechanisms must be implemented on the +server-side. Additional enforcement mechanisms may be implemented in the client, +but are not required. Accumulo's security relevant requirements are below: + + * To authenticate users at the RPC layer + * To authorize the users action against the relevant permission, if applicable, at the RPC layer + * To ensure that a user can only use Authorizations that they are assigned in a Scanner/BatchScanner + * To ensure that Key-Value pairs returned in a Scanner/BatchScanner are allowed given the scan Authorizations + * To ensure that files are encrypted/decrypted appropriately, if configured + +## Additional Considerations + + * Accumulo server logs will contain user data and should be secured + * The Accumulo Monitor web UI does not perform authorization, user data should not be passed over the REST endpoints + * Each entry in a bulk-imported file is NOT inspected to confirm that the visiblity label is valid + + \ No newline at end of file From 0c0d597b74f2fad3a7f948406b5789b380a3d669 Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Thu, 23 Jul 2026 17:33:49 +0000 Subject: [PATCH 2/8] Add license header --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 703cf5b8b54..6fa5a519d75 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,24 @@ + + ## Reporting a vulnerability If after reading this document you believe you have found a vulnerability or are unsure, From cef0fbf4e25ecee88f4f8503ebf560da13a2caa4 Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Fri, 24 Jul 2026 13:14:10 -0400 Subject: [PATCH 3/8] Update SECURITY.md Co-authored-by: Amanda Villarreal <48224036+Amemeda@users.noreply.github.com> --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 6fa5a519d75..0f79d7692d9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -45,7 +45,7 @@ are configured correctly and securely or are otherwise trusted. * Network, to include network encryption components * DNS - * Operating Systems and related compute hardware + * Operating Systems and related computer hardware * ZooKeeper and HCFS storage configured for Accumulo's use * Persons or processes that can log into an environment (bare-metal or container) where Accumulo, ZooKeeper, or HCFS-related processes are running From b203e3d6a5a9da9753043114b0c062ab2ac25929 Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Fri, 24 Jul 2026 13:14:22 -0400 Subject: [PATCH 4/8] Update SECURITY.md --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SECURITY.md b/SECURITY.md index 0f79d7692d9..68e7d44dbef 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -53,6 +53,7 @@ are configured correctly and securely or are otherwise trusted. * The JVM classpath for Accumulo processes (configured in accumulo-env.sh or similar mechanism) * User provided code that runs in the server process via an Accumulo SPI * User configured JVM agents + * Bulk-imported user created RFiles (these bypass server-side checks that are performed during live ingest) ## Accumulo Security Boundary and Responsibilities From f4f0aa26bad8506c7bb999a414d0cfb291c64672 Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Fri, 24 Jul 2026 13:14:33 -0400 Subject: [PATCH 5/8] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 68e7d44dbef..01c2e8053d8 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -46,7 +46,7 @@ are configured correctly and securely or are otherwise trusted. * Network, to include network encryption components * DNS * Operating Systems and related computer hardware - * ZooKeeper and HCFS storage configured for Accumulo's use + * ZooKeeper and HCFS installations and configuration * Persons or processes that can log into an environment (bare-metal or container) where Accumulo, ZooKeeper, or HCFS-related processes are running * Accumulo configuration files (e.g. accumulo-env.sh, accumulo.properties, logging configuration, etc.) From 0b2787702baf76faa35848fcb9935c29fce1e769 Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Fri, 24 Jul 2026 15:33:01 -0400 Subject: [PATCH 6/8] Update SECURITY.md Co-authored-by: Dom G. --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 01c2e8053d8..b85549bcbe0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -64,7 +64,7 @@ server-side. Additional enforcement mechanisms may be implemented in the client, but are not required. Accumulo's security relevant requirements are below: * To authenticate users at the RPC layer - * To authorize the users action against the relevant permission, if applicable, at the RPC layer + * To authorize the user's action against the relevant permission, if applicable, at the RPC layer * To ensure that a user can only use Authorizations that they are assigned in a Scanner/BatchScanner * To ensure that Key-Value pairs returned in a Scanner/BatchScanner are allowed given the scan Authorizations * To ensure that files are encrypted/decrypted appropriately, if configured From 9f2ea88d1e1ada6faed4fb50dabf7dfa7543c9ce Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Fri, 24 Jul 2026 15:54:17 -0400 Subject: [PATCH 7/8] Update SECURITY.md Co-authored-by: Dom G. --- SECURITY.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index b85549bcbe0..1128e650e48 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -18,7 +18,13 @@ under the License. --> +# Security Policy +## Supported Versions + +Security fixes are provided for [currently maintained release lines](https://accumulo.apache.org/versioning). Users should run the latest +patch release in a maintained line. See the [Accumulo downloads page](https://accumulo.apache.org/downloads/) +for current releases and maintenance status. ## Reporting a vulnerability If after reading this document you believe you have found a vulnerability or are unsure, From 725735169fc13dd0605624f316e1642bd31e3864 Mon Sep 17 00:00:00 2001 From: Dave Marion Date: Fri, 24 Jul 2026 16:11:27 -0400 Subject: [PATCH 8/8] Update SECURITY.md Co-authored-by: Dom G. --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1128e650e48..6ed54859347 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -36,8 +36,8 @@ Accumulo is designed to use Apache ZooKeeper for locking and coordination and one or more Hadoop Compatible File System (HCFS) implementations (HDFS, S3, local disk, etc.) for storage. Accumulo users could be humans or machines connecting to Accumulo server processes from any location. -Please see the Security section of the User Manual for information -regarding: +Please see the Security section of the User Manual (found at https://accumulo.apache.org/) +for information regarding: * User authentication * Authorizing actions and our permission scheme