CVE-2026-49845

CVE-2026-49845 is a SQL injection in Apache Hive before 4.2.1 affecting the Hive Metastore's direct-SQL partition-name resolution paths. The root cause is that client-supplied partition names are embedded into SQL via string concatenation (DirectSqlUpdatePart.quoteString()) rather than bind param...

CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...