CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token
Apache Impala CVE-2026-56207 allows forged SAML bearer tokens on the hs2-http interface, letting attackers impersonate other users; fixed in 4.5.2.
46
Vulnerability3 · 1 read
CVE-2026-56207
SAML2 authentication bypass in Apache Impala hs2-http via unverified bearer token
- CVSS 3.1
- 9.8 critical
- EPSS
- <1%p5
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Impala's final step of SAML2 authentication on its hs2-http interface accepts a Bearer token without verifying its cryptographic signature (CWE-347). An attacker with network access to the hs2-http endpoint can submit a forged bearer token with an altered user name, and Impala will accept it as valid. This lets the attacker impersonate another user and act as that user within Impala, bypassing the SAML2 authentication control. All Apache Impala releases from version 4.0.0 onward are affected when SAML2 authentication is used with the hs2-http interface; the issue is fixed in version 4.5.2. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and CVSS has not yet been assigned.
What to do: Upgrade to Apache Impala 4.5.2 as soon as practical. Until patched, restrict network access to the hs2-http interface and review hs2-http authentication/audit logs for sessions whose user name does not match corresponding IdP sign-in records to detect possible impersonation. Check whether your deployment actually uses SAML2 authentication on hs2-http, since other configurations are not affected, and watch the Apache advisory for CVSS scoring.
| Product | Affected |
|---|---|
| Apache Impala | >= 4.0.0 (fixed in 4.5.2) |
Estimated exposure
nichelikely low thousands of clusters at most; only Impala >= 4.0.0 deployments with SAML2 authentication enabled on the hs2-http interface — Impala is an enterprise data-lake SQL engine typically deployed inside private clusters (largely via Cloudera-style distributions) with no public install telemetry or internet-exposure scan data, and only the subset using SAML2 on hs2-http…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.