Impala Data Processing Software Vulnerability in Apache
CVE-2026-54048

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Impala
Vendor
CVE Published:
9 September 2026

What is CVE-2026-54048?

A vulnerability in Apache's Impala software, present in versions 2.0.0 through 4.5.1, arises when users specify 'tblproperties' with certain URL formats. An attacker can exploit this by triggering GET requests to internal endpoints that are typically inaccessible, potentially revealing sensitive information through error responses. Users are strongly advised to upgrade to version 4.5.2 to remediate this issue.

Affected Version(s)

Apache Impala 2.0.0 <= 4.5.1

References

https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zhaokaifei ChinaTelecom
.