---
id: "INC-qubole-swzv3fb1mp8z"
page: "https://infrastack.ai/live/INC-qubole-swzv3fb1mp8z"
kind: "incident"
aliases: []
title: "Qubole: Log4J Issue (CVE-2021-44228)"
severity: "low"
cvss: null
epss: null
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Qubole", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["incident", "java", "log4j", "qubole", "security", "self-hosted", "vendor"]
not_affected_if: ["control-plane-only", "managed-hosting"]
published_at: "2021-12-14T20:39:48+00:00"
first_seen_at: "2026-11-09T17:16:52+00:00"
updated_at: "2026-11-09T17:18:19+00:00"
sources: [{"source": "statuspage", "url": "https://stspg.io/v0712908tfz5", "first_seen_at": "2026-11-09T17:16:52+00:00"}]
exploit_sources: []
---

# Log4Shell: Qubole Log4J Issue (CVE-2021-44228)

Link for people: https://infrastack.ai/live/INC-qubole-swzv3fb1mp8z (this .md is for agents)

Qubole reported that its own hosted control plane contains no vulnerable Apache Log4j library, so it is not impacted by CVE-2021-44228. Customer-run data plane components can still contain the vulnerable library and need the mitigation Apache publishes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Qubole affected range not listed fixed no fixed version listed

## How to check

- Check the Apache Log4j version in your Qubole data plane (customer-controlled hardware) against the Apache Log4j security page: https://logging.apache.org/log4j/2.x/security.html

## Fix

- Follow the mitigation instructions Apache publishes at https://logging.apache.org/log4j/2.x/security.html for customer-controlled data plane environments
- No fixed version is stated by the Qubole source

## Timeline

- 2026-11-09T17:16:52+00:00 statuspage https://stspg.io/v0712908tfz5

## Documents

- [mentions] Aikido: What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained https://www.aikido.dev/blog/what-are-shell-vulnerabilities

## From the sources

Qubole’s investigation of the CVE-2021-44228 vulnerability in the Apache Log4j library continues to advance, with focus on identifying any exposed instance of a vulnerable Apache Log4j library as per Apache’s public updates.  Qubole consists of two parts: (1) the Control Plane, which resides on Qubole-controlled hardware and (2) the Data Plane, which resides on Customer-controlled hardware.  The investigation is guided by this structure.

Within the Control Plane (on Qubole-controlled hardware), our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. Therefore, the investigation confidently concludes the Control Plane is not impacted by the Apache Log4j vulnerability.  

For the Data Plane (on Customer-controlled hardware), we understand Qubole customers will want to take immediate action to protect the environments they control.  This immediate action can be achieved by following the mitigation instructions as published by Apache on the Apache website (https://logging.apache.org/log4j/2.x/security.html).

Although our initial and thorough investigation has concluded, and Qubole continues to monitor for potential breaches, we will continue actively to monitor this situation and communicate with stakeholders as appropriate.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_