61 matches found
CVE-2026-54048
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-56207
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-57866
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-65181
Apache Impala versions 2.7 through 4.5 are affected by an insufficient authorization issue in Data Source table handling. A client with sufficient privileges can upload a file to remote storage and create a table, enabling arbitrary Java code execution (RCE). The recommended remediation is to upg...
CVE-2026-57866
Apache Impala versions 4.4.x and 4.5.x are affected by a server-side request forgery (SSRF) vulnerability. Authenticated users with permission to execute the ai_generate_text() function can exfiltrate secrets stored in credential providers configured via the hadoop.security.credential.provider.pa...
CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
EUVD-2026-74799
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-56207
Apache Impala (>= 4.0.0) contains an authentication bypass in the SAML2 flow on its hs2-http interface. The Bearer token signature is not verified in the final step of the SAML2 authentication process, allowing an attacker to alter the user name and impersonate another user. Users should upgra...
EUVD-2026-74797
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-54048
Apache Impala versions 2.0.0 through 4.5.1 (all platforms) are affected by a Server-Side Request Forgery (SSRF) via the Avro schema URL table property. By specifying tblproperties('avro.schema.url'='http://...') or a file:/// URI, an attacker can cause Impala to issue a GET request to internal ne...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
EUVD-2018-3787
Malware in sbrugna...
EUVD-2017-14732
Malware in sbrugna...
EUVD-2018-3791
Malware in sbrugna...
EUVD-2017-14735
Malware in sbrugna...