CVE-2026-97720
Received Received - Intake

JWT Signature Bypass in Apache Impala Executors

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Apache Software Foundation

Description
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens.  Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-97720
EUVD
EUVD-2026-94222

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Impala 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is due to incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to 4.5.2. The webserver accepts any valid JWT without validating its signature, allowing attackers to access protected resources.

Detection Guidance

To detect this vulnerability, check if Impala executors are running versions up to 4.5.2 and if JWT/OAuth authentication is enabled on the webserver. Inspect the Impala version with commands like 'impala-shell --version' or check configuration files for JWT/OAuth settings.

Impact Analysis

Attackers could exploit this to gain unauthorized access to resources served by the Impala executor's webserver, potentially leading to data breaches or further system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA, potentially resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Immediately disable JWT/OAuth authentication for Impala executors or upgrade to Apache Impala version 4.5.3 or later to fix the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart