ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Apache Impala”

2 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 4
SeverityAllcritical 0high 2medium 2low 0info 0

CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token

Apache Impala CVE-2026-56207 allows forged SAML bearer tokens on the hs2-http interface, letting attackers impersonate other users; fixed in 4.5.2.

Apache Impala versions 4.0.0 through 4.5.1 fail to verify the bearer token signature in the final step of SAML2 authentication for the hs2-http interface. An attacker can alter the username and act as another user. Users are recommended to upgrade to version 4.5.2, and Apache rated the issue critical. It was reported by Andrew Rukin of Arenadata.

oss-security · 8d agoVulnerability 3 sourcesCVE-2026-562071

CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery

Apache Impala CVE-2026-54048 lets crafted Avro schema URLs trigger SSRF to internal endpoints, with responses potentially leaking via error messages.

A server-side request forgery in Apache Impala 2.0.0 through 4.5.1 on all platforms can be triggered via an Avro schema URL using an http or file:/// URI on a table. An attacker can cause Impala to send GET requests to internal endpoints it can access, and responses may be exposed through parsing error messages. Users are advised to upgrade to a fixed release.

oss-security · 8d agoVulnerabilityCVE-2026-540481