# CVE-2026-97720: Apache Impala JWT/OAuth signature validation bypass in executor webserver

Source: https://junglewise.ai/threats/cve-2026-97720-incorrect-implementation-of-jwt-oauth-authentication-in-impala  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-97720 · Severity: info · Published 2026-10-07

Apache Impala is an open-source query engine used for analytics on large datasets. When Impala executors are configured to use JWT or OAuth authentication for their web interface, the system fails to properly validate token signatures, allowing attackers to forge authentication tokens and access the executor's web resources without legitimate credentials.

Technologies: [Apache Impala](https://junglewise.ai/threats/technologies/apache-impala). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-97720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97720 being exploited in the wild.

**How severe is CVE-2026-97720?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** Apache Impala up to and including 4.5.2.

**Is there a fix for CVE-2026-97720?** Yes: fixed in 4.5.3. Until then: Disable JWT/OAuth authentication for Impala executors until upgrading to version 4.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97720?** Check whether you run Apache Impala at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.5.3

Disable JWT/OAuth authentication for Impala executors until upgrading to version 4.5.3 or later.

## Technical details

The vulnerability stems from incorrect JWT/OAuth implementation in Impala executors' webserver that does not validate Bearer token signatures. An attacker can craft a forged JWT token and gain unauthorized access to resources served by the executor webserver when JWT/OAuth authentication is enabled. No authentication bypass patch is required; users can disable JWT/OAuth auth as a mitigation or upgrade to the fixed version.

## Affected products

- Apache Impala up to and including 4.5.2

## Timeline

- 2026-10-07: disclosed

## References

- [https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2](https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2)

## Related threats

- [Apache Impala stored XSS in query plan Web UI](https://junglewise.ai/threats/cve-2026-93684-an-sql-user-using-impala-up-to-and-including-version-4-5-2-with)
- [Impala path traversal in trusted_jar_paths](https://junglewise.ai/threats/cve-2026-90466-path-traversal-of-trusted-jar-paths-in-impala-4-5-2-allows-an)