60
60
CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery
Apache Impala CVE-2026-54048 lets crafted Avro schema URLs trigger SSRF to internal endpoints, with responses potentially leaking via error messages.
A server-side request forgery in Apache Impala 2.0.0 through 4.5.1 on all platforms can be triggered via an Avro schema URL using an http or file:/// URI on a table. An attacker can cause Impala to send GET requests to internal endpoints it can access, and responses may be exposed through parsing error messages. Users are advised to upgrade to a fixed release.
32
60
60
60
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
55
30