189 matches found
CVE-2026-65181
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-54048
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-57866
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
CVE-2026-56207
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
EUVD-2026-74800
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-65181
Apache Impala versions 2.7 through 4.5 are affected by an insufficient authorization issue in Data Source table handling. A client with sufficient privileges can upload a file to remote storage and create a table, enabling arbitrary Java code execution (RCE). The recommended remediation is to upg...
CVE-2026-57866
Apache Impala versions 4.4.x and 4.5.x are affected by a server-side request forgery (SSRF) vulnerability. Authenticated users with permission to execute the ai_generate_text() function can exfiltrate secrets stored in credential providers configured via the hadoop.security.credential.provider.pa...
CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
EUVD-2026-74799
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
CVE-2026-56207
Apache Impala (>= 4.0.0) contains an authentication bypass in the SAML2 flow on its hs2-http interface. The Bearer token signature is not verified in the final step of the SAML2 authentication process, allowing an attacker to alter the user name and impersonate another user. Users should upgra...
CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
EUVD-2026-74797
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
EUVD-2026-74795
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-54048
Apache Impala versions 2.0.0 through 4.5.1 (all platforms) are affected by a Server-Side Request Forgery (SSRF) via the Avro schema URL table property. By specifying tblproperties('avro.schema.url'='http://...') or a file:/// URI, an attacker can cause Impala to issue a GET request to internal ne...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
EUVD-2025-116985
Malicious code in worldwide-violet-impala npm...
EUVD-2025-117240
Malicious code in mature-magenta-impala npm...
MAL-2025-139117 Malicious code in worldwide-violet-impala (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f50135ad83a162ed7b6ea016caf95136fdc6300729a22c7cc0c2469eb80bbc9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...