CVE-2015-7521
HighSummary
The authorization framework in Apache Hive versions 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0, and 1.2.1 allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
Risk Assessment
Attackers may gain access to data they should not have permissions for, potentially leading to data confidentiality breaches within the organization.
Recommendation
It is recommended to upgrade Apache Hive to the latest version to mitigate this vulnerability and review authorization policies to strengthen security.
Other vulnerabilities in Apache Hive
See all- CVE-2026-55976Critical
SSRF vulnerability in Apache Hive before 4.2.1 allows an authenticated attacker with CREATE TABLE privilege to force the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url property for an Avro table. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity.
- CVE-2026-49845Critical
SQL injection vulnerability in Apache Hive before 4.2.1 affects partition-name resolution in Hive Metastore when direct SQL is enabled. An authenticated user can craft partition names in RPC requests to alter the WHERE clause, allowing read, modification, or impact on metadata of unintended partitions (e.g., statistics updates, truncate targets, file-metadata cache operations).
- CVE-2026-53561High
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix.
Original NVD description (English source)
The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.