Apache Hive CVE-2026-55976

Requires an authenticated Hive session with CREATE TABLE (or equivalent DDL) privilege and network access to HiveServer2/Metastore; the attacker sets the avro.schema.url property on an Avro-SerDe table using an attacker-controlled URL (http/https/file/ftp scheme, e.g. targeting 169.254.169.254 or internal hosts), and the fetch triggers when that table is subsequently queried (the creator can query their own table; other users granted SELECT can also trigger it). External tables must typically be enabled - the default in most deployments. Limiting factors: exploitation is NOT unauthenticated despite the CVSS PR:N - a valid login plus DDL rights is mandatory; admin/superuser is not required; write access to the table LOCATION is not required; and the impact is a read-only server-side GET, so it exposes data rather than modifying it. In hardened clusters where untrusted users lack CREATE TABLE or where external tables are disabled, the path is closed.

The signals are mixed and should be weighed together. CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N), but the vector's PR:N conflicts with the authoritative description and Apache's own access notes, which state a valid Hive login plus CREATE TABLE (DDL) privilege is required - verify with vendor, and treat this as an authenticated flaw rather than a fully unauthenticated one. EPSS is low (0.29%, 21st percentile) and there is no KEV listing and no public exploit identified, suggesting this is not currently subject to broad opportunistic exploitation. Against that, the technical impact is high: SSRF from a Hive service identity in cloud environments can harvest instance-metadata credentials, and the prerequisite (ordinary DDL rights, external tables enabled by default) is common in real deployments, so the practical barrier is low for any insider or compromised low-privilege account. Net: a genuine priority for multi-tenant or cloud-hosted Hive clusters where untrusted users hold CREATE TABLE, and lower urgency for tightly locked-down single-tenant installs; the high CVSS should be tempered by the low EPSS and the authentication requirement, not taken at face value.

An analyst holding an ordinary Hive account with CREATE TABLE rights on a cloud-hosted cluster creates an Avro external table with avro.schema.url set to http://169.254.169.254/latest/meta-data/iam/security-credentials/, then runs a SELECT against it. Hive resolves the schema by fetching that URL under the service identity and surfaces or logs the cloud metadata response, handing the attacker instance credentials or internal service data. No public exploit is identified at time of analysis, but the low complexity (AC:L) means a working DDL/query pair is trivial to construct.