EUVD-2026-74795
GHSA-mjfw-8c8c-xr6h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SQL DDL access required (PR:L); SSRF reaches separate internal systems (S:C); partial confidentiality loss via error-message leakage of internal responses (C:L); GET-only, no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala daemon into issuing arbitrary HTTP or file-system GET requests by specifying a malicious URL in the avro.schema.url table property. Internal service responses reachable by Impala but not directly by the attacker are partially exposed through SQL parsing error messages, enabling internal network reconnaissance, cloud metadata enumeration, and local file disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker possess SQL access to Apache Impala with sufficient DDL privileges to execute CREATE TABLE or ALTER TABLE statements - at minimum, database-level CREATE permission granted to the attacker's identity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate but contextually significant for data-platform operators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary and recommended remediation is to upgrade Apache Impala to version 4.5.2, which resolves the SSRF by addressing the unvalidated URI fetch in the avro.schema.url handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Review Impala audit logs and table property configurations for instances where the avro.schema.url parameter references internal hostnames, IP addresses, or cloud metadata endpoints (e.g., 169.254.169.254). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 coul
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of
In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. Rated critical severity (CVSS 9.
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-stor
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent
Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. Rated high severi
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can i
In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any
Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to injec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today