CVE-2026-49845

Apache Hive versions prior to 4.2.1 are vulnerable to a SQL injection flaw in the Hive Metastore's direct SQL partition-name resolution. The root cause is the use of string concatenation in the DirectSqlUpdatePart.quoteString() function instead of bind parameters when resolving partitions by full...

CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...