Apache Software Foundation Impala vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Apache Software Foundation Impala: 3 record(s), with affected versions and fixes.cpe:2.3:a:apache:impala
CVE-2026-97720
Critical · 9.1
CWE-303 Oct 7, 2026
Apache Impala: Impala Executor Webserver Auth Bypass
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.
Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
CVE-2026-93684
Medium · 5.4
CWE-79 Oct 7, 2026
Apache Impala: Stored XSS in Impala query plans
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.
CVE-2026-90466
Medium · 6.5
CWE-23 Oct 7, 2026
Apache Impala: Path traversal executes JARs outside trusted paths
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin.
Users are recommended to upgrade to version 4.5.3, which fixes this issue.