Apache Impala

Related CVEsby mentions

• CVE-2026-562079.8<1%
  SAML2 authentication bypass in Apache Impala hs2-http via unverified bearer token
  Apache Impala's final step of SAML2 authentication on its hs2-http interface accepts a Bearer token without verifying its cryptographic signature (CWE-347). An attacker with network access to the hs2-http endpoint can submit a forged bearer token with an altered user name, and Impala will accept it as valid. This lets the attacker impersonate another user and act as that user within Impala, bypassing the SAML2 authentication control. All Apache Impala releases from version 4.0.0 onward are affected when SAML2 authentication is used with the hs2-http interface; the issue is fixed in version 4.5.2. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and CVSS has not yet been assigned.
  · Apache Impala >= 4.0.0 (fixed in 4.5.2)niche
• CVE-2026-578668.8<1%
  SSRF in Apache Impala lets authenticated users exfiltrate credential-provider secrets
  Apache Impala versions 4.4.x and 4.5.x contain a server-side request forgery (CWE-918) in the ai_generate_text() SQL function. An authenticated Impala user with permission to execute ai_generate_text() can trigger server-side requests that exfiltrate secrets supplied by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml, provided the user already knows the secret's key name. Successful exploitation lets an attacker read sensitive credentials held by the Impala service, such as storage or cloud keys, potentially enabling follow-on access to the systems those credentials protect. Only deployments running Impala 4.4.x or 4.5.x that have credential providers configured and permit users to call the affected function are exposed. There is no CVSS score yet, no known public proof-of-concept, and no evidence of exploitation in the wild; the issue is not on the CISA KEV list.
  · Apache Impala 4.4.x and 4.5.x
• CVE-2026-651818.1<1%
  Authenticated RCE in Apache Impala via Data Source table class loading
  CVE-2026-65181 is an insufficient-authorization flaw (CWE-913) in how Apache Impala handles Data Source tables, affecting all Impala releases from 2.7 through 4.5. An authenticated client who holds the privileges to upload a file to remote storage and to create a table can register a Data Source table whose custom Java classes Impala then loads, causing the service to execute attacker-controlled Java code. Successful exploitation yields remote code execution with high impact on confidentiality and integrity (CVSS 3.1: 8.1; no availability impact scored). Any organization running Impala 2.7-4.5 where non-administrative users can write to backend storage and issue CREATE TABLE statements is affected, while clusters where these privileges are restricted to administrators are largely not exposed. There is no evidence of exploitation to date — the issue is not on CISA's KEV list and no public proof-of-concept is known — and the Apache security team recommends upgrading to 4.5.2.
  · Apache Impala 2.7 through 4.5 (all releases prior to 4.5.2; fixed in 4.5.2)moderate
• CVE-2026-540485.3<1%
  Server-Side Request Forgery in Apache Impala via Avro Schema URL
  Apache Impala contains a server-side request forgery (CWE-918) in its handling of the Avro schema URL table property. An attacker who can create or alter a table can set tblproperties('avro.schema.url'='http://...') — or use a 'file:///' URI — causing Impala (versions 2.0.0 through 4.5.1, on all platforms) to issue a GET request to an internal endpoint that the attacker may not have direct access to but that Impala can reach. The attacker gains SSRF access to internal services reachable from Impala, and the response content may be disclosed back to the attacker through Avro schema parsing error messages. All users running affected Impala versions 2.0.0 to 4.5.1 are exposed, with risk concentrated in environments where users can define or modify table properties and Impala can reach internal endpoints such as management interfaces or cloud metadata services. There are no known public proof-of-concept exploits, no confirmed in-the-wild exploitation, and the issue is not listed in CISA's KEV; the flaw is fixed in Impala 4.5.2.
  · Apache Impala 2.0.0 to 4.5.1 (all platforms)moderate

Appears with