CVE-2026-57866
UnknownSummary
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml. The secret's key must be known to the user.
Risk Assessment
An attacker can steal secrets such as passwords or API keys, potentially leading to system security compromise.
Recommendation
Upgrade Apache Impala to a patched version (e.g., 4.5.2 or later).
Other vulnerabilities in Apache Impala
See all- CVE-2026-65181Unknown
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2.
- CVE-2026-56207Unknown
The Bearer token signature is not verified in the last step of SAML2 authentication for Impala's hs2-http interface, allowing alteration of the username and impersonation of another user. This affects Apache Impala versions >= 4.0.0.
- CVE-2026-54048Unknown
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does, and the response may be exposed via parsing error messages.
- CVE-2017-5640Critical
In Apache Impala versions 2.7.0 to 2.8.0, a vulnerability was identified that allows a malicious process to impersonate an Impala daemon. This can lead to skipping authentication checks when Kerberos is enabled but TLS is not used.
Original NVD description (English source)
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.