https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-65181.htmlhttps://patchthecve.com/cve/CVE-2026-65181.htmlThu, 10 Sep 2026 20:36:32 +0000HIGH 8.1: Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.https://patchthecve.com/cve/CVE-2026-57866.htmlhttps://patchthecve.com/cve/CVE-2026-57866.htmlThu, 10 Sep 2026 20:36:43 +0000HIGH 8.8: Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-sihttps://patchthecve.com/cve/CVE-2026-56207.htmlhttps://patchthecve.com/cve/CVE-2026-56207.htmlThu, 10 Sep 2026 20:38:05 +0000CRITICAL 9.8: Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.https://patchthecve.com/cve/CVE-2026-54048.htmlhttps://patchthecve.com/cve/CVE-2026-54048.htmlThu, 10 Sep 2026 20:38:42 +0000MEDIUM 5.3: Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error