Executive brief
Apache Hive is a data warehouse system used to query and manage large datasets stored on Hadoop clusters. An authenticated user with table creation privileges can craft a malicious Avro table that causes the Hive server to fetch attacker-controlled URLs when the table is queried. This can expose sensitive cloud metadata, internal network information, or local files accessible to the Hive process, potentially compromising the infrastructure and allowing lateral movement in cloud environments.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Apache Hive's Avro SerDe (serialization/deserialization) schema resolution mechanism. When resolving the avro.schema.url table property during query execution, Hive does not properly validate or restrict the URL being fetched, allowing an attacker to point it to arbitrary locations (http/https/file/ftp schemes, cloud metadata endpoints like 169.254.169.254, or internal hosts). An authenticated remote attacker with CREATE TABLE privilege can set a malicious avro.schema.url when defining an Avro table, and when any user queries that table (or the creator queries their own table), the Hive server will fetch the attacker-controlled URL in the context of the Hive process identity. This exposes cloud instance metadata, internal network services, or local files. The vulnerability is fixed in Apache Hive 4.2.1 and later.
Affected products
- Apache Hive before 4.2.1
Timeline
- 2026-08-25: disclosed
- 2026: patched: Fixed in version 4.2.1