Apache Impala (Apache Software Foundation) - vulnerabilities (CVEs)
13 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-07. Vendor: Apache Software Foundation.
CVEs of Apache Impala
- CVE-2026-93684 - CVSS 5.4 (medium), 2026-10-07: An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's…
- CVE-2026-90466 - CVSS 6.5 (medium), 2026-10-07: Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path…
- CVE-2026-97720 - CVSS 9.1 (critical), 2026-10-07: Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access…
- CVE-2026-65181 - CVSS 8.1 (high), 2026-09-09: Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to…
- CVE-2026-57866 - CVSS 8.8 (high), 2026-09-09: Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function…
- CVE-2026-56207 - CVSS 9.8 (critical), 2026-09-09: Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as…
- CVE-2026-54048 - CVSS 5.3 (medium), 2026-09-09: Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to…
- CVE-2021-28131 - CVSS 7.5 (high), 2021-07-22: Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs,…
- CVE-2018-11785 - CVSS 6.5 (medium), 2018-10-24: Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query,…
- CVE-2018-11792 - CVSS 9.8 (critical), 2018-10-24: In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a…
- CVE-2017-9792 - CVSS 6.5 (medium), 2017-10-04: In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the…
- CVE-2017-5652 - CVSS 7.5 (high), 2017-07-10: During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the…
- CVE-2017-5640 - CVSS 9.8 (critical), 2017-07-10: It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip…
