CVE-2026-54048

5.3 Moyenne

Publiée le 09/09/2026 à 13:17 · Modifiée le 10/09/2026 à 22:38 · Analysée par le NVD · Source : security@apache.org

Description

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Impala
Apache impala

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/08/21 Mailing ListThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories