Threat database

CVE-2026-93684 is a stored cross-site scripting (XSS) vulnerability in Apache Impala up to version 4.5.2. An SQL user with only SELECT permission can inject JavaScript code into a table alias, which executes in another user's browser when viewing the query plan in Impala's Web UI. This vulnerability allows limited impact on confidentiality and integrity but does not affect availability. Users are advised to upgrade to version 4.5.3 to remediate the issue.

CVE-2026-90466 is a relative path traversal vulnerability in Apache Impala versions 4.5.2 up to but not including 4.5.3. It allows an attacker to load a malicious JAR file via a relative path if the 'trusted_jar_paths' startup flag is configured with a non-empty value. The vulnerability is fixed in version 4.5.3.

CVE-2026-97720 is a critical vulnerability in Apache Impala versions 4.1.0 through 4.5.2 involving incorrect implementation of JWT/OAuth authentication. The flaw allows attackers to bypass signature validation of bearer tokens, enabling unauthorized access to resources served by the executor's webserver when JWT/OAuth authentication is enabled. The issue is fixed in version 4.5.3. Users are advised to disable JWT/OAuth authentication on Impala executors or upgrade to the patched version.

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

CVE-2026-57866 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Apache Impala versions 4.4.0 through 4.4.9 and 4.5.0 through 4.5.9. Authenticated users with permission to execute the ai_generate_text() function can exploit this flaw to exfiltrate secrets from credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml, provided they know the secret's key.

CVE-2026-56207 is a critical vulnerability in Apache Impala versions 4.0.0 through 4.5.1 where the signature of the Bearer token is not verified in the final step of SAML2 authentication for the hs2-http interface. This flaw allows an attacker to alter the user name and impersonate another user. The issue is fixed in version 4.5.2.

Apache Impala versions 2.0.0 through 4.5.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an attacker to specify a table property with an avro.schema.url pointing to an HTTP or file URI, causing Impala to issue GET requests to internal endpoints. The responses may be exposed through parsing error messages. The issue is fixed in version 4.5.2.