CVE-2026-56207
UnknownSummary
The Bearer token signature is not verified in the last step of SAML2 authentication for Impala's hs2-http interface, allowing alteration of the username and impersonation of another user. This affects Apache Impala versions >= 4.0.0.
Risk Assessment
An attacker can impersonate another user, potentially leading to unauthorized data access and integrity compromise.
Recommendation
Upgrade to version 4.5.2, which fixes this issue.
Other vulnerabilities in Apache Impala
See all- CVE-2026-65181Unknown
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2.
- CVE-2026-57866Unknown
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml. The secret's key must be known to the user.
- CVE-2026-54048Unknown
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does, and the response may be exposed via parsing error messages.
- CVE-2017-5640Critical
In Apache Impala versions 2.7.0 to 2.8.0, a vulnerability was identified that allows a malicious process to impersonate an Impala daemon. This can lead to skipping authentication checks when Kerberos is enabled but TLS is not used.
Original NVD description (English source)
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.