Apache Impala hit by three same-day CVEs: critical SAML auth bypass, SSRF secrets exfiltration, and RCE via external data source class loading

On 2026-09-08 Apache disclosed three Impala vulnerabilities via oss-security: a critical SAML2 bearer-token forgery bypassing authentication on hs2-http (CVE-2026-56207, fixed in 4.5.2), an important SSRF letting authenticated users exfiltrate Hadoop…

Three Apache Impala security advisories were posted to the oss-security mailing list on September 8, 2026. CVE-2026-56207, rated critical and reported by Andrew Rukin of Arenadata, affects Impala 4.0.0 through 4.5.1: the bearer token signature is not verified in the final step of SAML2 authentication for the hs2-http interface, so an attacker can alter the username and impersonate another user; Apache recommends upgrading to 4.5.2. CVE-2026-57866, rated important, is a server-side request forgery affecting Impala 4.4.0 through 4.5.1: authenticated users with permission to execute the ai_generate_text() function can exfiltrate secrets from credential providers configured via hadoop.security.credential.provider.path in core-site.xml, provided they already know the secret's key name; the disclosure did not state a fix version. CVE-2026-65181, also rated important by the Apache Software Foundation, is a remote code execution flaw triggered via class loading of external data sources; the disclosure likewise did not specify affected versions or a fixed release. No disagreements exist between the reports, though only CVE-2026-56207 includes a stated fix.