Impala (Apache) - vulnerabilities (CVEs)
12 CVEs, 1 in the last 30 days, 70 known versions, newest CVE from 2026-10-07. Vendor: Apache.
CVEs of Impala
- CVE-2026-90466 - CVSS 6.5 (medium), 2026-10-07: Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path…
- CVE-2026-65181 - CVSS 8.1 (high), 2026-09-09: Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to…
- CVE-2026-57866 - CVSS 8.8 (high), 2026-09-09: Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function…
- CVE-2026-56207 - CVSS 9.8 (critical), 2026-09-09: Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as…
- CVE-2026-54048 - CVSS 5.3 (medium), 2026-09-09: Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to…
- CVE-2021-28131 - CVSS 7.5 (high), 2021-07-22: Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs,…
- CVE-2019-10084 - CVSS 7.5 (high), 2019-11-05: In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries…
- CVE-2018-11792 - CVSS 9.8 (critical), 2018-10-24: In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a…
- CVE-2018-11785 - CVSS 6.5 (medium), 2018-10-24: Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query,…
- CVE-2017-9792 - CVSS 6.5 (medium), 2017-10-04: In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the…
- CVE-2017-5652 - CVSS 7.5 (high), 2017-07-10: During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the…
- CVE-2017-5640 - CVSS 9.8 (critical), 2017-07-10: It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip…
