CVE-2026-49845: CWE-94 Improper Control of Generation of Code ('Code Injection') in Apache Software Foundation Apache Hive

This vulnerability involves SQL injection in the Hive Metastore component of Apache Hive before version 4.2.1. Several Hive Metastore RPCs resolve partitions by full partition name using direct SQL helpers that embed client-supplied partition names via string concatenation instead of using bind parameters. A crafted partition name containing a single quote can modify the WHERE clause of SQL queries, causing unintended partitions to be matched and affected. The attack requires authenticated or network-trusted users with the ability to invoke Hive Metastore partition-name APIs and occurs when the 'metastore.try.direct.sql' setting is enabled (default: true). The impact is limited to partition-level metadata operations within tables accessible to the attacker and does not allow arbitrary cross-database access by itself.

An attacker with authenticated access to Hive Metastore APIs can exploit this vulnerability to read, modify, or affect unintended partition metadata, including statistics updates, truncation targets, and file-metadata cache operations. This can lead to unauthorized data manipulation or disruption of partition metadata integrity within tables the attacker can reference. The vulnerability has a CVSS score of 9.8, indicating critical severity with high confidentiality, integrity, and availability impacts. There is no indication of arbitrary cross-database access through this flaw alone.

Users are strongly recommended to upgrade Apache Hive to version 4.2.1 or later, where this vulnerability is fixed. Since the issue is caused by direct SQL concatenation of partition names, upgrading to the fixed version eliminates the risk. No other official remediation or temporary workaround is provided in the available data. Patch status is not explicitly confirmed in the vendor advisory content provided, but the description clearly states that version 4.2.1 fixes the issue.