Skip to main content
protocols.pageprotocols.page
8088

Port 8088 – YARN ResourceManager

TCP

Port 8088 is the Hadoop YARN ResourceManager web UI port providing cluster-wide job management, queue monitoring, and application status. The ResourceManager controls all cluster resource allocation. Unrestricted access enables job submission and resource manipulation. Enable Kerberos and restrict to admin networks.

Port Number

8088

Protocol

TCP

Service

Hadoop YARN ResourceManager Web UI

Range

IANA Registered (1024–49151)

Description

YARN ResourceManager on port 8088 serves the cluster management web interface showing all running applications, resource queues, node health, and scheduler state. Administrators use it to monitor cluster utilization, kill runaway applications, and adjust queue capacities. The ResourceManager on port 8088 is a high-value target – an attacker with access can submit MapReduce/Spark jobs that execute arbitrary code on cluster nodes, consume all cluster resources (denial of service), or read data from HDFS. Production Hadoop clusters must enable Kerberos authentication, use HTTPS (yarn.resourcemanager.webapp.https.address on port 8090), and restrict port 8088 to authorized administrators.

Security risks

  • 1Arbitrary application submission (RCE): an unauthenticated YARN ResourceManager on port 8088 allows submitting MapReduce/Spark applications via REST API (POST /ws/v1/cluster/apps/new-application + POST /ws/v1/cluster/apps). Attackers submit containers that execute arbitrary commands on cluster nodes – the primary vector for Hadoop crypto-mining campaigns since 2018.
  • 2CVE-2018-8029 (CVSS 9.8): Apache Hadoop YARN ResourceManager allows remote code execution via crafted application submission – attacker runs arbitrary code as the yarn user on any NodeManager in the cluster.
  • 3Cluster resource exhaustion: attackers submit applications requesting all available cluster memory/vCores, starving legitimate workloads (denial of service). Without queue ACLs, any submitted application gets resources.
  • 4Data exfiltration via container: submitted containers run as the yarn user and can access HDFS data, local NodeManager files, and environment variables containing credentials. A single exposed ResourceManager = full cluster compromise.
  • 5Application log access: the ResourceManager UI exposes stdout/stderr of all applications. Logs often contain connection strings, API tokens, and intermediate data samples. Restrict /ws/v1/cluster/apps/{appid}/appattempts/{attemptid}/containers/{containerid}/logs.

Firewall guidance

Never expose port 8088 to the internet – this is one of the most targeted Hadoop ports for crypto-mining attacks. Restrict to admin workstations and monitoring systems only. Enable Kerberos (hadoop.security.authentication = kerberos) which requires authenticated tickets for ALL API access. Use HTTPS (yarn.resourcemanager.webapp.https.address on port 8090) with SPNEGO authentication. In EMR/Dataproc: use security groups restricting to VPC CIDR.

Diagnosis commands

Check ResourceManager state and HA status

shell
curl -s http://rm-host:8088/ws/v1/cluster/info | jq '{state: .clusterInfo.state, haState: .clusterInfo.haState}'

List running applications (check for unauthorized submissions)

shell
curl -s http://rm-host:8088/ws/v1/cluster/apps?states=RUNNING | jq '.apps.app[].name'

List scheduler queues and their configs

shell
curl -s http://rm-host:8088/ws/v1/cluster/scheduler | jq '.scheduler.schedulerInfo.queues.queue[].queueName'

Detect exposed YARN ResourceManager (page title: 'All Applications')

shell
nmap -p 8088 --script http-title target

Usage examples

Port 8088 – YARN ResourceManager
shell
curl http://rm-host:8088/ws/v1/cluster/info
yarn application -list
http://resourcemanager:8088/cluster/apps

Common services on this port

Apache Hadoop YARNCloudera CDPHortonworks HDPAmazon EMRAzure HDInsightGoogle Dataproc

Related ports

8042

YARN NodeManager Web UI

8188

Timeline Server (application history)

8032

ResourceManager scheduler port

9870

HDFS NameNode Web UI

8090

YARN ResourceManager HTTPS

History

YARN (Yet Another Resource Negotiator) was introduced in Hadoop 2.0 (2012) to separate resource management from MapReduce, enabling Spark, Tez, and other frameworks to share cluster resources. Port 8088 was chosen for the ResourceManager web UI. The REST API on the same port for application submission became the primary attack vector when clusters were exposed without Kerberos. Major crypto-mining campaigns (DemonBot 2018, Kinsing 2020) specifically target port 8088.

FAQ

How do crypto-mining attacks exploit port 8088?

Attackers scan for open port 8088, then: (1) POST /ws/v1/cluster/apps/new-application to get an application ID, (2) POST /ws/v1/cluster/apps with a container spec that downloads and executes a crypto-miner (usually XMRig for Monero). The miner runs on every allocated NodeManager. Detection: monitor for unexpected applications, high CPU usage on NodeManagers, and outbound connections to mining pools (port 3333/5555).

Is Kerberos the only way to secure YARN?

Kerberos is the primary authentication mechanism for Hadoop. Alternatives: Apache Ranger (fine-grained authorization on top of Kerberos), Apache Knox (gateway proxy with LDAP/OAuth auth for REST APIs), or network isolation (private subnet + VPN). However, Kerberos is required for true security – without it, any API call on port 8088 is accepted. Cloud-managed Hadoop (EMR, Dataproc) handles Kerberos setup automatically.