Cloudera CDH prior to 5.6.1 allows authorization bypass via direct internal API calls.
cloudera cdh
cloudera cdh 5.6.0