PatchTheCVEimpala vulnerabilities and fixes
Recent CVEs affecting impala, with upgrade or downgrade steps. 4 tracked.
impala has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-09-09. Highest priority: CVE-2026-56207 (score 54/100).
- CVE-2026-54048 MEDIUM 5.3 UPGRADE Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0
- CVE-2026-56207 CRITICAL 9.8 UPGRADE Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface
- CVE-2026-57866 HIGH 8.8 UPGRADE Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permis
- CVE-2026-65181 HIGH 8.1 UPGRADE Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a
FAQ
How do I fix impala vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is impala being exploited right now?
None of the tracked impala CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which impala CVE should I patch first?
CVE-2026-56207 currently ranks highest (54/100): Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface.