CVE-2026-57866

HIGH 8.8

Apache Impala: Secrets Exfiltration via SSRF

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.

CWE	CWE-918
Vendor	apache software foundation
Product	apache impala
Published	Sep 9, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache impala

Be the first to know when new high vulnerabilities affecting apache software foundation apache impala are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Impala

4.4.0 ≤ 4.5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/nnk4660cbs6dmmkch7ch7wwb3g9myw7j openwall.com: http://www.openwall.com/lists/oss-security/2026/09/08/23

Credits

🔍 Andrey Rukin (Arenadata)