EUVD-2026-65394
GHSA-g32f-6xhp-3ffw
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SAML HTTP mode requires explicit non-default configuration (AC:H); no credentials needed once reachable (PR:N); no availability impact from authentication bypass alone.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix for this issue.
Access / authorization required: No Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. The attacker only needs network reachability to the HiveServer2 HTTP port (typically /cliservice), directly or through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HS2. The instance must have SAML authentication enabled in HTTP mode. Deployments where Knox handles SSO and HiveServer2 uses LDAP/Kerberos (not native SAML mode) are not affected by this specific issue.
Articles & Coverage 2
AnalysisAI
Authentication bypass in Apache HiveServer2 4.0.0-4.2.0 allows unauthenticated network attackers to impersonate any Hive user and obtain a fully authenticated HiveServer2 session when SAML mode is enabled over HTTP transport. The root cause is an inverted HMAC signature comparison in HiveSamlAuthTokenGenerator.java - the original code used !MessageDigest.isEqual(), causing all tokens to pass validation regardless of signature correctness, meaning a forged bearer token with any embedded username is unconditionally accepted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target HiveServer2 instance must have SAML authentication explicitly enabled via hive.server2.authentication=SAML AND must be operating in HTTP transport mode - both conditions must be true simultaneously, and neither is the Hive default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is well-reasoned: network vector with no privileges required drives the high severity, while AC:H reflects that SAML HTTP mode is a non-default, deliberately configured deployment state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Hive to version 4.2.1, which contains the fix per the Apache advisory at https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05 and the upstream commit 6ca06ca1104ff7462363087a867d70d546134774. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all HiveServer2 instances running versions 4.0.0-4.2.0 with SAML authentication enabled, verify their transport configuration, and immediately restrict inbound network access to these systems from untrusted networks until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Hive
View allSQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Me
Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rig
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today