CVE-2026-57866

Summary

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml. The secret's key must be known to the user.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache Impala4.4.0 <= 4.5.1affected

Weaknesses

  • CWE-918: CWE-918 Server-Side Request Forgery (SSRF)

ADP Enrichment

CVE Program Container

Additional References

References