Apache Impala
11 CVEs affecting Apache Impala. Latest disclosed: 2026-09-09. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56207 | Critical | 9.8 | 2026-09-09 | Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as anoth… |
CVE-2018-11792 | Critical | 9.8 | 2018-10-24 | In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a tabl… |
CVE-2017-5640 | Critical | 9.8 | 2017-07-10 | It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authenti… |
CVE-2026-57866 | High | 8.8 | 2026-09-09 | Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function… |
CVE-2026-65181 | High | 8.1 | 2026-09-09 | Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to exe… |
CVE-2021-28131 | High | 7.5 | 2021-07-22 | Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, theref… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2017-5652 | High | 7.5 | 2017-07-10 | During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluste… |
CVE-2018-11785 | Medium | 6.5 | 2018-10-24 | Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, lea… |
CVE-2017-9792 | Medium | 6.5 | 2017-10-04 | In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the… |
CVE-2026-54048 | Medium | 5.3 | 2026-09-09 | Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to… |