CVE-2026-93684: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Apache Software Foundation Apache Impala

CVE-2026-93684 is a stored cross-site scripting (XSS) vulnerability in Apache Impala affecting versions from 2.7.0 through 4.5.2. The flaw allows an SQL user with SELECT permission to inject JavaScript code into a table alias. When another user opens the query plan in the Impala Web UI, the injected script executes in their browser context, potentially leading to unauthorized script execution. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Apache Software Foundation recommends upgrading to version 4.5.3 to fix this issue.

The vulnerability allows an attacker with limited SQL SELECT permissions to execute arbitrary JavaScript in the browsers of users who view the affected query plans in the Impala Web UI. This could lead to session hijacking, unauthorized actions in the UI, or other impacts typical of stored XSS attacks. However, exploitation requires the victim to open the malicious query plan in the web interface.

A fix is available in Apache Impala version 4.5.3. Users should upgrade to this version to remediate the vulnerability. No other mitigation steps are indicated by the vendor advisory.