CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading

CVE-2026-65181 is an insufficient-authorization flaw (CWE-913) in how Apache Impala handles Data Source tables, affecting all Impala releases from 2.7 through 4.5. An authenticated client who holds the privileges to upload a file to remote storage and to create a table can register a Data Source table whose custom Java classes Impala then loads, causing the service to execute attacker-controlled Java code. Successful exploitation yields remote code execution with high impact on confidentiality and integrity (CVSS 3.1: 8.1; no availability impact scored). Any organization running Impala 2.7-4.5 where non-administrative users can write to backend storage and issue CREATE TABLE statements is affected, while clusters where these privileges are restricted to administrators are largely not exposed. There is no evidence of exploitation to date — the issue is not on CISA's KEV list and no public proof-of-concept is known — and the Apache security team recommends upgrading to 4.5.2.

Do: Upgrade all Impala coordinators and executors to version 4.5.2, which fixes this issue. Until patched, restrict table-creation (CREATE TABLE / Data Source) privileges and remote-storage write access (e.g., HDFS or object-store uploads) to trusted administrators, since those are the only privileges an attacker needs. Audit existing Data Source tables and review which users hold these privileges to assess your actual exposure.