Apache Impala EUVD-2026-94224

Exploitation requires (1) an authenticated Impala SQL account with at least SELECT permission to craft a table alias containing a JavaScript payload, and (2) a second, typically higher-privileged user to open that specific query plan in Impala's Web UI, where the stored payload executes - making victim interaction a hard prerequisite. Limiting factors: the Impala Web UI must be enabled and reachable by the victim; the attacker must already possess valid Impala credentials (not pre-auth); and impact is confined to the victim's browser security context rather than the Impala backend. These conditions make the flaw most relevant in multi-tenant Impala clusters where untrusted or lower-trust users share the environment with administrators.

This is a moderate-severity stored XSS (CWE-79) in Apache Impala's Web UI query-plan rendering, confirmed by the Apache vendor advisory and oss-security posting. No CVSS vector, EPSS score, KEV listing, or public POC is provided in the input, so quantitative exploitation-probability signals are entirely absent - this assessment is grounded in the description and vendor severity rating only. The vendor's own rating is 'moderate,' consistent with a stored XSS that requires an attacker to already hold a valid authenticated Impala SQL account (described as needing only SELECT permission) and that further depends on a separate victim user opening the malicious query plan in the Web UI. These two preconditions (low-privilege authenticated insider + victim interaction) substantially limit real-world risk versus a pre-auth network RCE, despite the network-reachable Web UI. There is no evidence of active exploitation ('no public exploit identified at time of analysis'), and the absence of EPSS/KEV data should NOT be read as low risk - it simply means those feeds were not supplied. Net: a credible insider/second-order-compromise issue worth patching in multi-tenant Impala deployments, but not an emergency mass-exploitation threat on current evidence. Note the input provides NO official CVSS vector, so all attack-vector/privilege claims below are the analyst's own assessment, not NVD-confirmed.

A low-privileged analyst who holds only SELECT rights on a table runs or saves a query that embeds a JavaScript payload inside a table alias. When a higher-privileged operator or administrator later opens that query's plan in Impala's Web UI, the stored script executes in the admin's authenticated browser session, enabling session-context actions such as cookie/token theft or UI actions on the victim's behalf. No public proof-of-concept exploit is identified in the provided data.