Executive brief
Apache Impala is a distributed SQL query engine used for analytics on big data. A vulnerability in how Impala handles external data source tables allows an authenticated user to upload files to remote storage and create malicious tables that execute arbitrary Java code, enabling complete system compromise. This is a significant risk for organizations using Impala for data processing pipelines.
Technical details
The vulnerability is an insufficient authorization flaw in Impala's external data source table functionality (CWE-269). The vulnerable component improperly validates privileges when users create external data source tables, failing to restrict which data sources can be used. An authenticated attacker with table creation privileges can upload arbitrary files to remote storage and craft a malicious external data source table that loads and executes arbitrary Java code, achieving remote code execution. The vulnerability affects Impala versions 2.7.0 through 4.5.1; patched version 4.5.2 is available.
Affected products
- Apache Impala 2.7.0 through 4.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-09: patched: Fixed in Apache Impala 4.5.2