Executive brief
Apache Impala is a distributed query engine used to analyze large datasets. A vulnerability allows attackers to craft SQL table properties that force Impala to make HTTP requests to internal systems it has access to but the attacker does not, potentially exposing sensitive data through error messages.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Apache Impala's Avro schema handling. The vulnerable code accepts arbitrary URLs (http://, file:///) in the tblproperties('avro.schema.url') parameter without proper validation. When Impala attempts to fetch the schema from the specified URL, it makes the request using its own network privileges and credentials. Error messages during schema parsing may leak the response content or metadata from internal endpoints the attacker cannot directly access. The vulnerability affects versions 2.0.0 through 4.5.1. Attack requires ability to execute CREATE or ALTER TABLE statements; if the attacker already has SQL query access, they can exploit this to probe internal infrastructure. Apache Impala 4.5.2 and later fix this issue.
Affected products
- Apache Impala 2.0.0 to 4.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-09: patched: Apache Impala 4.5.2 released