CVE-2026-49845
Received Received - Intake

SQL Injection in Apache Hive Metastore

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Apache Software Foundation

Description
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue. Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-49845
EUVD
EUVD-2026-65396

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache hive 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Apache Hive before version 4.2.1. It occurs in the Hive Metastore when direct SQL partition-name resolution is enabled. Authenticated users with access to Hive Metastore APIs can exploit crafted partition names containing SQL code to manipulate partition metadata. The issue stems from using string concatenation instead of parameterized queries when embedding partition names into SQL statements.

Detection Guidance

To detect this vulnerability, check if your Hive Metastore is running with direct SQL enabled (default true) and if any authenticated users have access to Hive Metastore APIs. Review logs for unusual partition name patterns or failed queries. No specific commands are provided in the context.

Impact Analysis

An attacker could read, modify, or delete unintended partition data including statistics updates, truncation targets, and file-metadata cache operations. They could target wrong partitions within tables they have access to, potentially causing data corruption or incorrect query results. The impact is limited to partition-level operations within accessible tables.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in data breaches if partition metadata containing sensitive information is exposed or altered. Organizations using affected Hive versions would need to assess potential compliance impacts and implement mitigations.

Mitigation Strategies

Upgrade Apache Hive to version 4.2.1 or later to fix the issue. If upgrading is not immediately possible, disable direct SQL in Hive Metastore by setting metastore.try.direct.sql=false in configuration. Ensure only trusted users have access to Hive Metastore APIs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart