What is CVE-2026-53561?

CVE-2026-53561 is a high-severity vulnerability in Apache Hive, classified under Improper Authentication. CVSS score: 7.4/10. Published 2026-08-25.

How severe is CVE-2026-53561?

High severity. CVSS v3 base score is 7.4 out of 10.

Auth bypass in Apache Hive

CVE-2026-53561

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix for this issue. Access / authorization required: No Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. The attacker only needs network reachability to the HiveServer2 HTTP port (typically /cliservice), directly or through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HS2. The instance must have SAML authentication enabled in HTTP mode. Deployments where Knox handles SSO and HiveServer2 uses LDAP/Kerberos (not native SAML mode) are not affected by this specific issue.

Vulnerability class: Broken Authentication

Published 2026-08-25 · last modified 2026-09-28.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.003 (25.3th percentile), scored 2026-10-10.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.001

Affected products

Weakness classification (CWE)

References

github.com/apache/hive (Product, product)
issues.apache.org/jira/browse/HIVE-29653 (issue-tracking, Vendor Advisory)
github.com/apache/hive/commit/6ca06ca1104ff7462363087a867d70d546134774 (Patch, patch)
lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05 (vendor-advisory, Mailing List, Vendor Advisory)

Frequently asked questions

What is CVE-2026-53561?: CVE-2026-53561 is a high-severity vulnerability in Apache Hive, classified under Improper Authentication. CVSS score: 7.4/10. Published 2026-08-25.
How severe is CVE-2026-53561?: High severity. CVSS v3 base score is 7.4 out of 10.