Apache Impala: four vulnerabilities disclosed on 2026-09-08, including critical SAML authentication bypass (CVE-2026-56207)
Four Apache Impala vulnerabilities were disclosed via oss-security on 2026-09-08: SSRF via Avro schema URLs (CVE-2026-54048, affecting 2.0.0 through 4.5.1), a critical SAML authentication bypass via forged bearer tokens on the hs2-http interface…
On September 8, 2026, four Apache Impala vulnerabilities were disclosed via the oss-security mailing list. CVE-2026-54048 is a server-side request forgery affecting Impala 2.0.0 through 4.5.1 on all platforms, triggered via an Avro schema URL using an http or file:/// URI on a table. An attacker can cause Impala to send GET requests to internal endpoints it can access, and responses may be exposed through parsing error messages. Users are advised to upgrade to a fixed release; the report does not name a specific fixed version. CVE-2026-56207 affects Impala 4.0.0 through 4.5.1 on the hs2-http interface: the bearer token signature is not verified in the final step of SAML2 authentication, allowing an attacker to alter the username and impersonate another user. Apache rated this issue critical and it is fixed in Impala 4.5.2. It was reported by Andrew Rukin of Arenadata. CVE-2026-57866 is an SSRF affecting Impala 4.4.0 through 4.5.1. Authenticated users with permission to execute the ai_generate_text() function can exfiltrate secrets provided by credential providers configured via hadoop.security.credential.provider.path in core-site.xml, provided they know the secret's key name. Apache rated it important; no fixed version is stated. CVE-2026-65181 is a remote code execution vulnerability triggered via class loading of external data sources, rated important by the Apache Software Foundation. The report does not state affected versions or a fixed release. No disagreements were found among the four reports. The main gaps are the unstated affected and fixed versions for CVE-2026-65181 and the unstated fixed versions for CVE-2026-54048 and CVE-2026-57866.
- Four Apache Impala vulnerabilities (CVE-2026-54048, CVE-2026-56207, CVE-2026-57866, CVE-2026-65181) were disclosed via the oss-security mailing list on 2026-09-08.
- CVE-2026-54048: SSRF via Avro schema URL; affects Impala 2.0.0 through 4.5.1 on all platforms; supports both http and file:/// URIs; causes Impala to send GET requests to internal endpoints; responses may leak through parsing error…
- CVE-2026-56207: SAML2 bearer token signature not verified in the final authentication step on the hs2-http interface; affects Impala 4.0.0 through 4.5.1; allows impersonation of arbitrary users by altering the username; rated critical by…
- CVE-2026-57866: SSRF via the ai_generate_text() function; affects Impala 4.4.0 through 4.5.1; lets authenticated users with execute permission exfiltrate secrets from Hadoop credential providers configured via…
- CVE-2026-65181: remote code execution via class loading of external data sources; rated important by the Apache Software Foundation; affected versions and fixed release not stated in the reports.
- Impala 4.5.2 is the only fixed version named in the reports (for CVE-2026-56207); the advisories for the other three CVEs do not specify fixed releases.
- Stated affected ranges overlap: 2.0.0 through 4.5.1 (CVE-2026-54048), 4.0.0 through 4.5.1 (CVE-2026-56207), 4.4.0 through 4.5.1 (CVE-2026-57866).
- Severity ratings stated in the reports: CVE-2026-56207 critical; CVE-2026-57866 and CVE-2026-65181 important; no severity rating stated for CVE-2026-54048.
Coverage timelineoldest first · each row is one article
- · 7d agoCVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery
oss-security· 32
Apache Impala CVE-2026-54048 lets crafted Avro schema URLs trigger SSRF to internal endpoints, with responses potentially leaking via error messages.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-56207 | SAML2 authentication bypass in Apache Impala hs2-http via unverified bearer token Apache Impala's final step of SAML2 authentication on its hs2-http interface accepts a Bearer token without verifying its cryptographic signature (CWE-347). An attacker with network access to the hs2-http endpoint can submit a forged bearer token with an altered user name, and Impala will accept it as valid. This lets the attacker impersonate another user and act as that user within Impala, bypassing the SAML2 authentication control. All Apache Impala releases from version 4.0.0 onward are affected when SAML2 authentication is used with the hs2-http interface; the issue is fixed in version 4.5.2. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and CVSS has not yet been assigned. Do: Upgrade to Apache Impala 4.5.2 as soon as practical. Until patched, restrict network access to the hs2-http interface and review hs2-http authentication/audit logs for sessions whose user name does not match corresponding IdP sign-in records to detect possible impersonation. Check whether your deployment actually uses SAML2 authentication on hs2-http, since other configurations are not affected, and watch the Apache advisory for CVSS scoring. | 9.8 group max | <1% |
| nichelikely low thousands of clusters at most; only Impala >= 4.0.0 deployments with SAML2 authentication enabled on the hs2-http interface |