EUVD-2026-94222
GHSA-g6xq-6pmr-p37c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach executor webserver over network
-
DeliveryCraft arbitrary unsigned JWT
-
ExploitPresent bearer token to webserver
-
ExecutionSignature check bypassed, token accepted
-
ImpactAccess protected executor resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication algorithm review
|
| Exploitation Conditions | Exploitation requires that the Impala executor's internal webserver be explicitly configured to accept JWT/OAuth bearer-token authentication - this is the specific, necessary precondition and is not the default for all deployments. Where enabled, exploitation is remote and unauthenticated in the sense that no valid/legitimate token is required: the attacker needs only network reachability to the executor webserver and any syntactically valid JWT, since signatures are not checked. The primary limiting factors are therefore (1) the non-default JWT/OAuth configuration and (2) network access to the executor webserver endpoint; the documented mitigation is to disable JWT/OAuth auth for executors or upgrade to 4.5.3. |
| Impact | Signals are mostly aligned toward a serious but conditional confidentiality issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.1 Critical, reflecting a remote, low-complexity authentication bypass: because JWT signatures are never validated, any well-formed bearer token is accepted (CWE-303). However, the high score is gated by a non-default precondition - the executor webserver must be explicitly configured to accept JWT/OAuth tokens - so PR:N is technically correct (no legitimate credential is needed) but real-world reach is narrower than the raw score implies. The EPSS score is low (0.20%, 9th percentile), and there is no CISA KEV listing and no identified public exploit, so there is no evidence of active or widespread exploitation at this time. The 'Information Disclosure' tag and the description ('access resources served by the executor's webserver') suggest the practical impact is primarily unauthorized data/endpoint access rather than full system compromise, which is in mild tension with the vendor's I:H integrity claim - the description does not clearly establish a write/modify primitive. Net: a genuine high priority specifically for shops that have enabled JWT/OAuth auth on Impala executors, but a non-issue for the (likely majority) of deployments that have not. |
| Exploit ScenarioDerived | An attacker with network access to an Impala executor webserver that is configured to accept JWT/OAuth bearer tokens forges or reuses any syntactically valid JWT with arbitrary claims. Because the signature is not verified, the webserver accepts the token and serves protected resources to the attacker without any valid credential. No public exploit code has been identified, but the flaw is trivial to exercise with a hand-crafted token. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 07, 2026
Improper JWT/OAuth bearer-token validation in Apache Impala executors (versions 4.1.0 through 4.5.2) lets remote, unauthenticated attackers read resources exposed by an executor's internal webserver, because JWT signatures are never verified and any syntactically valid token is accepted. The exposure is conditional: it only applies where the executor webserver has been explicitly configured to accept JWT/OAuth bearer-token authentication, which is not the default, and the attacker must have network reachability to that webserver endpoint. EPSS is low (0.20%, ~9th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the flaw is trivially exploitable once the non-default configuration is in place; the assessed impact is high confidentiality with limited integrity loss, and the vendor fix is Impala 4.5.3 or disabling JWT/OAuth on executors.
Earlier versions of this analysis (1)
Missing JWT signature validation in the Apache Impala executor webserver (versions 4.1.0 through 4.5.2) lets unauthenticated remote attackers reach resources served by that webserver whenever it is explicitly configured to accept JWT/OAuth bearer tokens, since any structurally valid token is accepted without verifying its signature. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, so impact is confidentiality-only and there is no effect on integrity or availability; no public exploit identified at time of analysis. The critical limiting factor is that JWT/OAuth acceptance on executors is not a default configuration, so only deployments that have deliberately enabled it (and that do not rely on Kerberos/Ranger instead) are exposed - which keeps this a genuinely low-priority issue despite the bypass.
RemediationAI
Apply the vendor-released patch by upgrading Apache Impala to version 4.5.3, which fixes this issue across the affected 4.1.0-4.5.2 range; this is the primary and recommended action. If upgrade cannot be scheduled immediately, the documented compensating control is to disable JWT/OAuth authentication on the Impala executor webserver so that unsigned or forged bearer tokens are no longer an accepted credential path - the trade-off is loss of token-based access to executor endpoints, which may break integrations or tooling that rely on JWT/OAuth for executor monitoring, so plan an alternative access mechanism (for example network-level access control or mutual TLS) before disabling it. Additionally, restrict network reachability to the executor webserver (bind it to trusted interfaces, block its port at the perimeter, and allow only management hosts) to reduce exposure while patches roll out; this does not fix the underlying verification defect and should be treated as defense in depth rather than a substitute for upgrading. Note that Impala versions must be kept consistent across coordinators and executors when upgrading. Consult the vendor advisory at https://impala.apache.org/ and the oss-security announcement https://seclists.org/oss-sec/2026/q4/81, plus the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-97720, for the authoritative fix guidance. No public exploit code or confirmed active exploitation was identified at time of analysis, so emergency out-of-band patching is not signaled by threat intelligence, but the low attack complexity warrants prioritizing the upgrade for any deployment with executor JWT/OAuth enabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-303 (Incorrect Implementation of Authentication Algorithm): Apache Impala's executor-side webserver, when configured to accept JWT/OAuth bearer tokens, parses incoming JSON Web Tokens but does not validate the cryptographic signature on the JWS. In a correct implementation the server would verify the token against the issuer's signing key (HMAC secret or RSA/EC public key) and reject any token whose signature, issuer, audience, or expiry does not match policy. Here the authentication check reduces to structural acceptance of a well-formed JWT, so an attacker can mint a token with arbitrary claims - for example any subject or role - and gain access to resources the webserver serves, including administrative and status endpoints normally gated behind token auth. The weakness sits in the executor's embedded HTTP service rather than in Impala's query engine or the coordinator, and per EUVD the affected lineage spans Apache Impala 4.1.0 through 4.5.2. Because the CVSS vector carries PR:N, no legitimate credentials or prior authentication are required for a successful attempt; the practical gating factors are the non-default JWT/OAuth configuration of the executor webserver and network access to it.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Signature bypass means any JWT is accepted so PR:N/AC:L over the network; impact is mainly unauthorized resource/data access (C:H) with limited, unproven integrity effect (I:L) and no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Apache Impala versions 4.1.0 through 4.5.2 contain a critical authentication bypass that could allow unauthorized access to data exposed by its executor webserver, but only when a non-default JWT/OAuth configuration is enabled and the endpoint is network-reachable. Organizations running these versions with that configuration are at risk of confidentiality breaches; leadership should prioritize verifying configuration and applying the vendor's fix.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB