CVE-2026-55976: CWE-918 Server-Side Request Forgery (SSRF) in Apache Software Foundation Apache Hive

This vulnerability arises from the Avro SerDe schema resolution process in Apache Hive versions prior to 4.2.1. An authenticated remote attacker with CREATE TABLE privileges can set the avro.schema.url table property to an attacker-controlled URL. When the table is queried, Hive fetches this URL, potentially exposing sensitive internal resources such as cloud metadata services or local files. The attack does not require SELECT privileges on the table for the attacker who created it, nor admin rights, only the ability to create tables and network access to Hive services. Detection involves monitoring table metadata for suspicious avro.schema.url values and analyzing HiveServer2 and Metastore logs for unusual fetch activity. The issue is fixed in version 4.2.1.

Successful exploitation can lead to unauthorized disclosure of sensitive internal resources including cloud instance metadata and internal network services accessible by the Hive server process. This may facilitate further attacks or data leakage. The vulnerability does not allow privilege escalation or denial of service directly but compromises confidentiality of internal information.

Users should upgrade Apache Hive to version 4.2.1 or later, where this vulnerability is fixed. Until upgrading, monitor Hive table metadata for suspicious avro.schema.url values and audit HiveServer2 and Metastore logs for unexpected outbound requests triggered by schema resolution. Restrict CREATE TABLE privileges to trusted users and consider disabling external tables if not required. No official patch link or advisory was provided, so check the Apache Hive project resources for the latest updates.