CVE-2026-49845: CWE-94 Improper Control of Generation of Code ('Code Injection') in Apache Software Foundation Apache Hive

This vulnerability involves SQL injection in the Hive Metastore's direct SQL partition-name resolution mechanism. Several Hive Metastore RPCs use direct SQL helpers that embed client-supplied partition names into SQL queries using string concatenation rather than bind parameters. If a partition name contains crafted SQL (e.g., a single quote), it can alter the WHERE clause to match unintended rows, affecting reads, updates, truncations, and cache operations on partitions. The attack requires authenticated or network-trusted access to Hive Metastore partition-name APIs and only impacts partitions within tables the attacker can reference. The default configuration enables direct SQL, making this vulnerability exploitable unless mitigated. The issue is resolved in version 4.2.1.

An attacker with authenticated access to Hive Metastore APIs can exploit this vulnerability to read or modify unintended partition metadata, including statistics updates, truncation targets, and file-metadata cache operations. This can lead to unauthorized data access and modification within the scope of partitions in tables accessible to the attacker. The vulnerability does not allow arbitrary cross-database access by itself but can disrupt partition-level operations, potentially impacting data integrity and availability.

Users should upgrade Apache Hive to version 4.2.1 or later, where this vulnerability is fixed. Since the issue arises when direct SQL is enabled (which is the default), disabling direct SQL (setting metastore.try.direct.sql to false) can serve as a temporary mitigation if upgrading is not immediately possible. No other vendor advisories indicate additional mitigations or that the issue is already mitigated.