Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN988
_____________________________________________________________________

DATE                : 08/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Impala versions prior to
                                          4.5.3.

====================================================================
https://lists.apache.org/thread.html/ltxbm7nd7l0dw3wfb6nvk0bsc7bb8qsx
https://lists.apache.org/thread.html/51tf2x5c15q0gp2owc34zt9fctts5kg3
https://lists.apache.org/thread.html/0g0klw2jp879fkl347ps56fj45fkgfs0
_____________________________________________________________________

CVE-2026-90466: Apache Impala: Path traversal executes JARs outside
trusted paths

Severity: important 

Affected versions:

- Apache Impala 4.5.2 before 4.5.3

Description:

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an 
attacker-controlled JAR to be loaded via a relative path where the
prefix matches a path specified in 'trusted_jar_paths'.




The startup flag 'trusted_jar_paths' references URIs for loading
files from local or remote filesystems. Path traversal can't override
the schema, but can result in loading a JAR that has been uploaded
to a different location in that filesystem via Impala DDLs such as
CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used
if a trusted path exists, so this attack requires 'trusted_jar_paths'
have a non-empty value configured by the Impala admin.


Users are recommended to upgrade to version 4.5.3, which fixes this
issue.

This issue is being tracked as IMPALA-15345


Credit:

Andrew Rukin (Arenadata) (reporter)


References:

https://impala.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90466
https://issues.apache.org/jira/browse/IMPALA-15345
_____________________________________________________________________

CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans

Severity: moderate 

Affected versions:

- Apache Impala 2.7.0 through 4.5.2

Description:

An SQL user using Impala up to and including version 4.5.2 with only
SELECT permission can put JavaScript in a table alias and make it run
in another user's browser when that user opens the query plan in
Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to
upgrade to version 4.5.3.


Credit:

Andrew Rukin (Arenadata) (finder)


References:

https://impala.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-93684

_____________________________________________________________________

CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass

Severity: low 

Affected versions:

- Apache Impala 4.1.0 through 4.5.2

Description:

Incorrect implementation of JWT/OAuth authentication in Impala
executors in Apache Impala versions up to and including 4.5.2 which
allows attacked to access resources served by the executor's
webserver when that webserver is configured to accept JWT/OAuth
tokens.  Bearer token (JWT) signatures are not validated resulting in
the webserver accepting any valid JWT.

Users are recommended to either disable JWT/OAuth auth for Impala
executors or upgrade to version 4.5.3, which fixes this issue.


Credit:

Andrew Rukin (Arenadata) (finder)


References:

https://impala.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-97720

_____________________________________________________________________


_____________________________________________________________________




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================