CVE-2026-53561
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix.
Risk Assessment
The risk is critical because an attacker without any credentials can gain access to HiveServer2 as any user, potentially leading to unauthorized data access and operations. The vulnerability only affects deployments with SAML authentication enabled in HTTP mode.
Recommendation
Upgrade Apache Hive to version 4.2.1 or later immediately, which includes the fix. If not possible, consider disabling SAML authentication in HTTP mode or applying additional network security measures.
Other vulnerabilities in Apache Hive
See all- CVE-2015-7521High
The authorization framework in Apache Hive versions 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0, and 1.2.1 allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
- CVE-2026-55976Critical
SSRF vulnerability in Apache Hive before 4.2.1 allows an authenticated attacker with CREATE TABLE privilege to force the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url property for an Avro table. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity.
- CVE-2026-49845Critical
SQL injection vulnerability in Apache Hive before 4.2.1 affects partition-name resolution in Hive Metastore when direct SQL is enabled. An authenticated user can craft partition names in RPC requests to alter the WHERE clause, allowing read, modification, or impact on metadata of unintended partitions (e.g., statistics updates, truncate targets, file-metadata cache operations).
Original NVD description (English source)
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix for this issue. Access / authorization required: No Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. The attacker only needs network reachability to the HiveServer2 HTTP port (typically /cliservice), directly or through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HS2. The instance must have SAML authentication enabled in HTTP mode. Deployments where Knox handles SSO and HiveServer2 uses LDAP/Kerberos (not native SAML mode) are not affected by this specific issue.