63 matches found
...[ More ]
Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...
CVE-2026-57866
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
CVE-2026-54048
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-56207
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-65181
Apache Impala versions 2.7 through 4.5 are affected by an insufficient authorization flaw in Data Source tables that enables remote code execution (RCE) via external data source class loading . A client with existing privileges can upload a file to remote storage and create a table, which trigger...
CVE-2026-57866
A Server Side Request Forgery (SSRF) vulnerability in Apache Impala versions 4.4.x and 4.5.x allows authenticated users with permission to execute the ai_generate_text() function to exfiltrate secrets stored in credential providers configured via the hadoop.security.credential.provider.path prope...
CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
EUVD-2026-74799
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...
CVE-2026-56207
Apache Impala (>=4.0.0) has a SAML2 authentication bypass in its hs2-http interface. The signature of the Bearer token is not verified in the final step of the SAML2 authentication flow, allowing an attacker to alter the user name and impersonate another user without valid credentials. The vul...
CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
EUVD-2026-74797
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-54048
Apache Impala versions 2.0.0 through 4.5.1 (all platforms) are affected by a server-side request forgery (SSRF) vulnerability in the avro.schema.url table property. An attacker can specify an http:// or file:/// URI, causing Impala to issue a GET request to internal endpoints the attacker cannot ...
PT-2026-88922
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
EUVD-2017-14732
Malware in sbrugna...
EUVD-2018-3787
Malware in sbrugna...