Stored XSS Vulnerability in Impala Web UI by Apache
CVE-2026-93684

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Impala
Vendor: CVE Published:; 7 October 2026

What is CVE-2026-93684?

An SQL user with only SELECT permissions can exploit a flaw in Apache Impala up to version 4.5.2 by inserting JavaScript code into a table alias. When another user views the query plan through Impala's Web UI, this malicious script executes in their browser, potentially compromising their session and data. To enhance security, users should upgrade to version 4.5.3.

Affected Version(s)

Apache Impala 2.7.0 <= 4.5.2

References

https://lists.apache.org/thread.html/qxjj5n3vsttxbvq2n75x...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 7, 2026
Vulnerability Reserved
Sep 18, 2026

Credit

Andrew Rukin (Arenadata)

CVE-2026-93684 Data

JSON