Vulnerability intelligence
CVE-2026-56207
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.
CVSS Score
—
Unrated
EPSS — Exploit Probability
0.5%
Riskier than 39% of all CVEs · checked 2026-10-22
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Unconfirmed
Check vendor advisories
1 article across 1 outlet · first covered Sep 9, 2026 · latest Sep 9, 2026
Coverage timeline
-
Apache Impala Flaws Let Attackers Seize Analytics Clusters Remotelysecurityonline.info · Sep 9, 2026