HIGH 8.8 NVD
CVE-2026-57866
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function c
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.
Affected Products
- apache/impala
References
- https://lists.apache.org/thread/nnk4660cbs6dmmkch7ch7wwb3g9myw7j
- http://www.openwall.com/lists/oss-security/2026/09/08/23
- https://www.openwall.com/lists/oss-security/2026/09/08/23
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-09-09 via NVD. Affected: apache/impala.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.