CVE-2026-65181

Analyzed Analyzed - Analysis Complete

Insufficient Authorization Leading to Arbitrary Code Execution in Impala

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Apache Software Foundation

Description

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-65181

EUVD

EUVD-2026-74800

Affected Vendors & Products

Vendor	Product	Version / Range
apache	impala	From 2.7.0 (inc) to 4.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-913	The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Impala versions 2.7.0 through 4.5.1 allows a client with privileges to upload files to remote storage and create tables to execute arbitrary Java code due to insufficient authorization for Data Source tables.

Detection Guidance

To detect this vulnerability, check the version of Apache Impala running on your system. Run commands like 'impalad --version' or check package managers (e.g., 'rpm -qa | grep impala' or 'dpkg -l | grep impala'). If the version is between 2.7.0 and 4.5.1, the system is vulnerable.

Impact Analysis

An attacker could exploit this to run malicious Java code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. Users should upgrade to Impala 4.5.2 to fix this issue.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized execution of arbitrary Java code through insufficient authorization in Data Source tables. Unauthorized code execution may lead to data breaches or unauthorized access to sensitive information, which are key concerns under these regulations.

Mitigation Strategies

Immediately upgrade Apache Impala to version 4.5.2 or later. Follow your distribution's update process or download the patched version from the official Apache Impala website. Ensure no untrusted users have file upload or table creation privileges.

Hi! I’m here to help you understand CVE-2026-65181. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70