Story · 1 source · 3 articlesfirst Sep 8, 21:37 UTCupdated Sep 8, 21:41 UTC (7d ago)

Apache Impala hit by three same-day CVEs: critical SAML auth bypass, SSRF secrets exfiltration, and RCE via external data source class loading

highVulnerabilityimportance 46CVE-2026-56207 CVE-2026-65181 CVE-2026-57866

What's new: First merged summary for this story: consolidates three separate oss-security postings from 2026-09-08 (21:37, 21:39, and 21:41 UTC) into a single Apache Impala security roundup; no prior summary existed.

Merged summary · glm-5.3 · rewritten as coverage arrives

On 2026-09-08 Apache disclosed three Impala vulnerabilities via oss-security: a critical SAML2 bearer-token forgery bypassing authentication on hs2-http (CVE-2026-56207, fixed in 4.5.2), an important SSRF letting authenticated users exfiltrate Hadoop…

Three Apache Impala security advisories were posted to the oss-security mailing list on September 8, 2026. CVE-2026-56207, rated critical and reported by Andrew Rukin of Arenadata, affects Impala 4.0.0 through 4.5.1: the bearer token signature is not verified in the final step of SAML2 authentication for the hs2-http interface, so an attacker can alter the username and impersonate another user; Apache recommends upgrading to 4.5.2. CVE-2026-57866, rated important, is a server-side request forgery affecting Impala 4.4.0 through 4.5.1: authenticated users with permission to execute the ai_generate_text() function can exfiltrate secrets from credential providers configured via hadoop.security.credential.provider.path in core-site.xml, provided they already know the secret's key name; the disclosure did not state a fix version. CVE-2026-65181, also rated important by the Apache Software Foundation, is a remote code execution flaw triggered via class loading of external data sources; the disclosure likewise did not specify affected versions or a fixed release. No disagreements exist between the reports, though only CVE-2026-56207 includes a stated fix.

All three vulnerabilities were disclosed via the oss-security mailing list on 2026-09-08
CVE-2026-56207 (critical): bearer token signature not verified in the final step of SAML2 authentication on the hs2-http interface; affects Apache Impala 4.0.0 through 4.5.1; allows impersonation of arbitrary users by altering the…
CVE-2026-57866 (important): SSRF affecting Apache Impala 4.4.0 through 4.5.1; authenticated users with permission to execute ai_generate_text() can exfiltrate secrets from Hadoop credential providers configured via…
CVE-2026-65181 (important): remote code execution in Apache Impala via class loading of external data sources; rated important by the Apache Software Foundation; affected versions and fix not specified in the disclosure
The three CVEs overlap in affected versions where stated: 4.4.0–4.5.1 is covered by both CVE-2026-56207 and CVE-2026-57866

VendorsApache Arenadata

ProductsApache Impala Hadoop

Coverage timelineoldest first · each row is one article

Sep 8, 21:37 UTC · 7d ago
oss-security· 46
CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token
Apache Impala CVE-2026-56207 allows forged SAML bearer tokens on the hs2-http interface, letting attackers impersonate other users; fixed in 4.5.2.
Sep 8, 21:39 UTC · 7d ago
oss-security· 33
CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF
Apache Impala CVE-2026-57866 lets authenticated users abuse ai_generate_text() to exfiltrate secrets from configured Hadoop credential providers via SSRF.
Sep 8, 21:41 UTC · 7d ago
oss-security· 45
CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading
Apache Impala CVE-2026-65181 allows remote code execution through class loading of external data sources; rated important by Apache.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-56207 +2 in the same advisory: …57866 …65181	SAML2 authentication bypass in Apache Impala hs2-http via unverified bearer token Apache Impala's final step of SAML2 authentication on its hs2-http interface accepts a Bearer token without verifying its cryptographic signature (CWE-347). An attacker with network access to the hs2-http endpoint can submit a forged bearer token with an altered user name, and Impala will accept it as valid. This lets the attacker impersonate another user and act as that user within Impala, bypassing the SAML2 authentication control. All Apache Impala releases from version 4.0.0 onward are affected when SAML2 authentication is used with the hs2-http interface; the issue is fixed in version 4.5.2. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and CVSS has not yet been assigned. Do: Upgrade to Apache Impala 4.5.2 as soon as practical. Until patched, restrict network access to the hs2-http interface and review hs2-http authentication/audit logs for sessions whose user name does not match corresponding IdP sign-in records to detect possible impersonation. Check whether your deployment actually uses SAML2 authentication on hs2-http, since other configurations are not affected, and watch the Apache advisory for CVSS scoring.	9.8 group max	<1%		Apache Impala >= 4.0.0 (fixed in 4.5.2)	nichelikely low thousands of clusters at most; only Impala >= 4.0.0 deployments with SAML2 authentication enabled on the hs2-http interface	6d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-56207

+2 in the same advisory: …57866 …65181

SAML2 authentication bypass in Apache Impala hs2-http via unverified bearer token

Apache Impala's final step of SAML2 authentication on its hs2-http interface accepts a Bearer token without verifying its cryptographic signature (CWE-347). An attacker with network access to the hs2-http endpoint can submit a forged bearer token with an altered user name, and Impala will accept it as valid. This lets the attacker impersonate another user and act as that user within Impala, bypassing the SAML2 authentication control. All Apache Impala releases from version 4.0.0 onward are affected when SAML2 authentication is used with the hs2-http interface; the issue is fixed in version 4.5.2. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and CVSS has not yet been assigned.

Do: Upgrade to Apache Impala 4.5.2 as soon as practical. Until patched, restrict network access to the hs2-http interface and review hs2-http authentication/audit logs for sessions whose user name does not match corresponding IdP sign-in records to detect possible impersonation. Check whether your deployment actually uses SAML2 authentication on hs2-http, since other configurations are not affected, and watch the Apache advisory for CVSS scoring.

9.8

group max

<1%

Apache Impala >= 4.0.0 (fixed in 4.5.2)

nichelikely low thousands of clusters at most; only Impala >= 4.0.0 deployments with SAML2 authentication enabled on the hs2-http interface

6d ago