CVE-2026-49845

CVE-2026-49845 is a SQL injection in Apache Hive before 4.2.1 affecting the Hive Metastore's direct-SQL partition-name resolution paths. The root cause is that client-supplied partition names are embedded into SQL via string concatenation (DirectSqlUpdatePart.quoteString()) rather than bind param...

CVE-2026-55976

Apache Hive before 4.2.1 is vulnerable to a Server-Side Request Forgery (SSRF) in its Avro SerDe schema resolution component. The root cause is insufficient input validation on the avro.schema.url table property: an authenticated attacker with CREATE TABLE privilege and network access to HiveServ...