APACHE Impala has four high-severity vulnerabilities that could let attackers take remote control of large analytics clusters. The flaws include an authentication bypass and remote code execution, along with server-side request forgery (SSRF) issues. The advisory notes that there is currently no confirmed active exploitation or public PoCs, but the combination of bypass and code execution raises the severity for anyone running Impala in production.
The most serious flaw, CVE-2026-56207, is described as an authentication bypass affecting Impala’s hs2-http interface where the Bearer token signature is not verified in the final step of SAML2 authentication, potentially allowing an attacker to impersonate another user. CVE-2026-65181 enables code execution, with a privilege-limited client able to upload files and run arbitrary Java code via external data source tables.
Two SSRF flaws, CVE-2026-57866 and CVE-2026-54048, could let an attacker exfiltrate secrets or force the server to query internal endpoints. Affected versions span from 2.7.0 up to 4.5.1 for the RCE issue, and 4.0.0 through 4.5.1 for the authentication bypass.
Apache Software Foundation released a fix in a recent update; administrators are advised to upgrade to Apache Impala 4.5.2 promptly. Delaying this patch leaves big data deployments exposed to unauthorised access and potential data theft.