Executive brief
Apache Hive's Metastore component is vulnerable to SQL injection when resolving partition names. An authenticated attacker can craft malicious partition names to access, modify, or delete unintended data across partitions within tables they have access to. This could lead to unauthorized data exposure, data corruption, or deletion of critical table partitions in data warehouses relying on Hive.
Technical details
The vulnerability is a SQL injection flaw in Hive Metastore's direct-SQL partition resolution logic. Client-supplied partition names are embedded into SQL queries via string concatenation (DirectSqlUpdatePart.quoteString()) instead of parameterized queries, allowing single-quote characters in crafted partition names to break out of SQL string contexts and modify WHERE clauses. An authenticated user with access to Hive Metastore RPCs can inject SQL through partition names to target unintended partitions for read, update, truncate, or cache operations. The attack requires direct SQL resolution to be enabled (metastore.try.direct.sql=true, the default), and impact is scoped to partition operations within accessible tables, not arbitrary cross-database queries. The vulnerability is fixed in Apache Hive 4.2.1 and later.
Affected products
- Apache Hive before 4.2.1
Timeline
- 2026-08-25: disclosed
- 2026: patched: Fix available in Apache Hive 4.2.1