[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0aab5697-0850-d932-a226-d666c1de940f@apache.org>
Date: Tue, 06 Oct 2026 22:05:32 +0000
From: Michael Smith <michaelsmith@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth
Bypass
Severity: low
Affected versions:
- Apache Impala 4.1.0 through 4.5.2
Description:
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.
Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Credit:
Andrew Rukin (Arenadata) (finder)
References:
https://impala.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-97720
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
