CVE-2026-53561: CWE-287 Improper Authentication in Apache Software Foundation Apache Hive

CVE-2026-53561 is an improper authentication vulnerability (CWE-287) in Apache Hive's HiveServer2 SAML bearer-token validation for HTTP transport with hive.server2.authentication=SAML enabled. An unauthenticated network attacker can forge an Authorization: Bearer token and send it to the /cliservice HTTP endpoint to obtain an authenticated HiveServer2 session as an arbitrary user. This affects Apache Hive versions 4.0.0 through 4.2.0 and unreleased later branches. The attack requires network reachability to the HiveServer2 HTTP port but no credentials or knowledge of the server signing secret. Deployments using Knox for SSO with LDAP/Kerberos authentication are not vulnerable. Users are advised to upgrade to version 4.2.1 which includes a fix for this issue.

An unauthenticated attacker with network access to the HiveServer2 HTTP port can impersonate any Hive user and gain an authenticated session, potentially leading to unauthorized access to Hive data and operations. This compromises confidentiality and integrity of the Hive service. Availability is not affected. The vulnerability requires SAML authentication enabled in HTTP mode and is not exploitable if Knox handles SSO with other authentication methods.

Users should upgrade Apache Hive to version 4.2.1 or later, which includes a fix for this vulnerability. Until upgrading, deployments should consider disabling SAML authentication in HTTP mode or restricting network access to the HiveServer2 HTTP port. Deployments using Knox for SSO with LDAP/Kerberos authentication are not affected by this issue. Patch status is not explicitly stated in the input data but the recommendation to upgrade to 4.2.1 indicates an official fix is available.