Impala
Monthly
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-storage upload privileges to load and execute arbitrary Java classes on Impala daemon nodes by exploiting insufficient authorization controls over External Data Source tables. The vulnerability abuses Impala's legitimate extensibility feature - Data Source tables - which permits custom Java class loading from remote storage; insufficient authorization checks mean any user holding those two combined privileges can weaponize the feature for server-side code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; upgrade to 4.5.2 is the vendor-confirmed fix.
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `ai_generate_text()` function to exfiltrate secrets stored in Hadoop Credential Providers configured via `hadoop.security.credential.provider.path` in `core-site.xml`. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation pressure.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala daemon into issuing arbitrary HTTP or file-system GET requests by specifying a malicious URL in the `avro.schema.url` table property. Internal service responses reachable by Impala but not directly by the attacker are partially exposed through SQL parsing error messages, enabling internal network reconnaissance, cloud metadata enumeration, and local file disclosure. Reported by zhaokaifei of ChinaTelecom, the vulnerability is resolved in version 4.5.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external". Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-storage upload privileges to load and execute arbitrary Java classes on Impala daemon nodes by exploiting insufficient authorization controls over External Data Source tables. The vulnerability abuses Impala's legitimate extensibility feature - Data Source tables - which permits custom Java class loading from remote storage; insufficient authorization checks mean any user holding those two combined privileges can weaponize the feature for server-side code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; upgrade to 4.5.2 is the vendor-confirmed fix.
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `ai_generate_text()` function to exfiltrate secrets stored in Hadoop Credential Providers configured via `hadoop.security.credential.provider.path` in `core-site.xml`. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation pressure.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala daemon into issuing arbitrary HTTP or file-system GET requests by specifying a malicious URL in the `avro.schema.url` table property. Internal service responses reachable by Impala but not directly by the attacker are partially exposed through SQL parsing error messages, enabling internal network reconnaissance, cloud metadata enumeration, and local file disclosure. Reported by zhaokaifei of ChinaTelecom, the vulnerability is resolved in version 4.5.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external". Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.