Improper Authentication

Apache Hive is vulnerable to improper authentication. The vulnerability is due to improper validation of SAML bearer tokens, which allows an unauthenticated network attacker to forge an Authorization: Bearer token and authenticate as an arbitrary Hive user, thereby obtaining an authenticated...

Improper Authentication

Overview org.apache.hive:hive-service is a package for reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Improper Authentication through the doSamlAuth process in...

CVE-2026-53561

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561

Apache Hive versions 4.0.0 through 4.2.0 are vulnerable to an improper authentication flaw in the HiveServer2 SAML bearer-token validation. When using HTTP transport with hive.server2.authentication=SAML, the doSamlAuth process in ThriftHttpServlet.java and HiveSamlAuthTokenGenerator.java fails t...

CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

EUVD-2026-65394

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

PT-2026-81255

Name of the Vulnerable Software and Affected Versions Apache Hive versions 4.0.0 through 4.2.0 Description Improper authentication occurs during SAML bearer-token validation in HiveServer2 on deployments using HTTP transport with hive.server2.authentication=SAML. An unauthenticated network attack...

CVE-2026-53561: Improper Authentication

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

EUVD-2018-0777

Malware in sbrugna...

GHSA-5GVM-HRW5-H6XF Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

GHSA-RRFQ-G5FQ-FC9C Improper Authentication in hive:hive-exec

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use...

Authorization Bypass

hive-exec is vulnerable to an authorization bypass. The library does not provide an authorization fallback if the standard ranger,sql or sentry authorizer is not used, allowing a malicious user to gain unauthorized access to local resources on the HiveServer2 machine...

CVE-2018-11777

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use...

CVE-2018-11777: Undefined Security Weakness

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use...

PT-2018-10815

Name of the Vulnerable Software and Affected Versions Apache Hive versions 2.3.3, 3.1.0 and earlier Description The issue arises when local resources on HiveServer2 machines are not properly protected against malicious users, specifically if ranger, sentry, or SQL standard authorizer is not in us...

CVE-2018-1284

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs xpath/xpathstring/xpathboolean/xpathnumber/xpathdouble/xpathfloat/xpathlong/xpathint/xpathshort to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user usually hive if...

CVE-2018-1284

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs xpath/xpathstring/xpathboolean/xpathnumber/xpathdouble/xpathfloat/xpathlong/xpathint/xpathshort to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user usually hive if...