Google Cloud Dataproc Security Risks & Misconfigurations | Qualys | Qualys
Summary: Qualys TotalCloud researchers describe an unauthenticated access vulnerability in Google Cloud Dataproc in which the YARN ResourceManager on port 8088 and the HDFS NameNode on port 9870 require no authentication and serve all IP addresses. An attacker who compromises any workload on the same VPC - a Compute Engine instance, Cloud Run, or AppEngine - can use it as a tunnel to reach both interfaces, submit jobs, and read or manipulate data in the Hadoop Distributed File System.
Why it matters: Internet reachability alone is the prerequisite for full access to the cluster's primary storage system, and Qualys notes this direct NameNode exposure is absent in AWS EMR and Azure HDInsight, which restrict access by default. Qualys is adding a control (CID 52139) for Dataproc clusters on the default VPC, meaning clusters already deployed there must be migrated to reduce the risk.
Read the original at Qualys Blog ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026‘Canister Worm’ Springs Wiper Attack Targeting Iran Cyber Risks ·