CVE-2026-55976: CWE-918 Server-Side Request Forgery (SSRF) in Apache Software Foundation Apache Hive

The vulnerability in Apache Hive before 4.2.1 involves SSRF in the Avro SerDe schema resolution process. An attacker with CREATE TABLE privileges can specify a malicious avro.schema.url property that causes the Hive server to fetch data from attacker-controlled or sensitive internal URLs during query execution. This can expose sensitive internal resources such as cloud metadata services or local files to the Hive process identity. The attack requires network access to HiveServer2 or Metastore and valid authentication but does not require elevated admin rights. The issue is fixed in Apache Hive version 4.2.1.

An authenticated attacker with CREATE TABLE privileges can exploit this SSRF vulnerability to make the Hive server fetch arbitrary URLs, potentially exposing sensitive internal resources such as cloud instance metadata, internal network services, or local server files. This can lead to information disclosure impacting confidentiality and integrity, but does not affect availability. The vulnerability has a CVSS score of 9.1 (critical).

A fix is available in Apache Hive version 4.2.1. Users are strongly recommended to upgrade to this version to remediate the vulnerability. Detection can be aided by inspecting metastore and Hive table metadata for suspicious avro.schema.url values, reviewing HiveServer2 and Metastore logs for schema-resolution failures or unexpected outbound fetches, and monitoring cloud instance or VPC flow logs for unusual metadata service access. No temporary or alternative mitigations are specified beyond upgrading.