EUVD-2026-65394
GHSA-g32f-6xhp-3ffw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify HiveServer2 HTTP endpoint
-
DeliveryConfirm SAML authentication mode active
-
ExploitCraft forged bearer token with target username in key-value format
-
ExecutionBase64-encode and submit via Authorization: Bearer to /cliservice
-
PersistInverted signature check unconditionally accepts forged token
-
ImpactObtain authenticated HiveServer2 session as arbitrary user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target HiveServer2 instance must have SAML authentication explicitly enabled via hive.server2.authentication=SAML AND must be operating in HTTP transport mode - both conditions must be true simultaneously, and neither is the Hive default. The attacker requires only network reachability to the HiveServer2 HTTP endpoint (default port 10001) or to a reverse proxy such as Apache Knox that forwards requests to HiveServer2 in native SAML mode; no Hive credentials, SAML IdP session, or server signing secret is required. Deployments are NOT affected if: Knox handles SSO while HiveServer2 uses LDAP or Kerberos natively; HiveServer2 uses TCP/binary transport instead of HTTP; or any Hive version outside 4.0.0-4.2.0 is in use. The non-default SAML configuration requirement is the primary limiting factor for assessing realistic exposure in a given environment. |
| Impact | The vendor CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is well-reasoned: network vector with no privileges required drives the high severity, while AC:H reflects that SAML HTTP mode is a non-default, deliberately configured deployment state. EPSS at 0.14% (4th percentile) indicates very low current exploitation probability and no observed automated scanning activity. Absence from CISA KEV confirms no confirmed active exploitation at time of analysis. Despite low EPSS, the vulnerability's conceptual simplicity is a meaningful risk multiplier: the forged token requires only correctly formatting a Base64-encoded key-value string with the target username - no cryptographic material, IdP interaction, or server secrets are needed. Deployments using Apache Knox as an SSO reverse proxy that forwards requests to HiveServer2 in native SAML mode face particular exposure, as Knox-level authentication does not prevent the HS2 token validation failure. The CVSS C:H and I:H accurately reflect that a successful attacker gains a full HiveServer2 session with the impersonated user's data access and write privileges. |
| Exploit ScenarioDerived | An attacker with network reachability to the HiveServer2 HTTP port (or a Knox proxy forwarding to it) constructs a forged bearer token by Base64-encoding a crafted key-value string such as u=hiveadmin;id=1;time=<current_epoch>;rs=anyvalue;sg=bogus and submits it in an Authorization: Bearer header to the /cliservice endpoint. Because the signature comparison was inverted in the vulnerable versions, HiveServer2 unconditionally accepts the token and returns a valid authenticated session for the specified username - no cryptographic knowledge or IdP interaction required. No public POC has been identified at time of analysis, but the attack is directly reproducible from the commit diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 26, 2026
Authentication bypass in Apache HiveServer2 4.0.0-4.2.0 allows unauthenticated network attackers to impersonate any Hive user and obtain a fully authenticated HiveServer2 session when SAML mode is enabled over HTTP transport. The root cause is an inverted HMAC signature comparison in HiveSamlAuthTokenGenerator.java - the original code used !MessageDigest.isEqual(), causing all tokens to pass validation regardless of signature correctness, meaning a forged bearer token with any embedded username is unconditionally accepted. No CISA KEV listing and an EPSS of 0.14% (4th percentile) indicate no confirmed active exploitation at time of analysis, but the logic flaw is trivially exploitable once the deployment condition is met.
Earlier versions of this analysis (1)
Authentication bypass in Apache Hive's HiveServer2 (versions 4.0.0 through 4.2.0) lets an unauthenticated network attacker forge a SAML bearer token and open a fully authenticated HiveServer2 session as an arbitrary Hive user. It affects only deployments running HTTP transport with hive.server2.authentication=SAML, where the /cliservice endpoint mishandles bearer-token signature verification. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix is public and the root cause (an inverted signature check) is trivially weaponizable once the vulnerable configuration is known.
RemediationAI
Upgrade Apache Hive to version 4.2.1, which contains the fix per the Apache advisory at https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05 and the upstream commit 6ca06ca1104ff7462363087a867d70d546134774. For deployments unable to upgrade immediately, the most effective compensating control is switching HiveServer2 to an unaffected authentication mode - setting hive.server2.authentication to LDAP or KERBEROS removes the vulnerable SAML token validation path entirely, but requires reconfiguring IdP integration and client connectivity. As a secondary control, restrict network access to the HiveServer2 HTTP port (default 10001) to trusted hosts only using firewall rules or network ACLs; note that Knox-fronted deployments must apply this restriction at the HiveServer2 layer, not just the Knox perimeter, since Knox may forward unauthenticated requests inward. Disabling HTTP transport (reverting to TCP/binary mode) also eliminates the attack surface but may break SAML-dependent clients.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache HiveServer2 supports SAML-based SSO through the hive.server2.authentication=SAML configuration with HTTP transport mode. After IdP authentication, HiveServer2 issues internal session bearer tokens: Base64-encoded, HMAC-signed key-value strings (format: u=<user>;id=<id>;time=<epoch>;rs=<relaystate>;sg=<signature>) that clients present to the /cliservice endpoint. CWE-287 (Improper Authentication) is the root cause class. The specific bug in HiveSamlAuthTokenGenerator.java was a boolean inversion: return !MessageDigest.isEqual(...) was used instead of return MessageDigest.isEqual(...), so valid tokens were rejected and all other tokens - including entirely forged ones - were accepted as valid. A secondary parser flaw (split(SEPARATOR) without a limit argument) allowed a crafted signature field containing separator characters to manipulate the parsed key-value map and potentially bypass field extraction. The commit 6ca06ca1104ff7462363087a867d70d546134774 corrects the inversion, enforces explicit UTF-8 encoding for consistent HMAC computation across JVM locales, limits the split to prevent injection, and adds ThriftHttpServlet.java Base64 decoding before token parsing. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_hive:*:*:*:*:*:*:*:* for versions 4.0.0 through 4.2.0.
Know when Apache Hive gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SAML HTTP mode requires explicit non-default configuration (AC:H); no credentials needed once reachable (PR:N); no availability impact from authentication bypass alone.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix for this issue.
Access / authorization required: No Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. The attacker only needs network reachability to the HiveServer2 HTTP port (typically /cliservice), directly or through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HS2. The instance must have SAML authentication enabled in HTTP mode. Deployments where Knox handles SSO and HiveServer2 uses LDAP/Kerberos (not native SAML mode) are not affected by this specific issue.
Articles & Coverage 2
Executive ViewAI
Apache HiveServer2 versions 4.0.0-4.2.0 contain an authentication bypass flaw that permits unauthenticated network attackers to forge valid bearer tokens and impersonate any Hive user when SAML mode is deployed over HTTP, creating direct risk of unauthorized access to enterprise data warehouse systems. Organizations running affected versions with SAML authentication must treat this as a critical security gap despite its current low EPSS percentile, as the attack requires only network access and no technical sophistication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Hive
View allSQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Me
Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rig
Exploit-DB