Medium severity · published Sep 9, 2026
CVE-2026-54048
Apache Impala: Avro Schema URL Server-Side Request Forgery
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Apache Impala · Apache Software Foundation
2.0.0 through 4.5.1 · source: vendor
IM
Impala · Apache
2.7.0 before 4.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54048
Mailing List
https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/08/21
More from Apache Impala
9.8
CVE-2026-56207
Apache Impala: SAML authentication bypass via forged bearer token
9.1
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass
8.8
CVE-2026-57866
Apache Impala: Secrets Exfiltration via SSRF
8.1
CVE-2026-65181
Apache Impala: RCE via External Data Source Class Loading
6.5
CVE-2026-90466
Apache Impala: Path traversal executes JARs outside trusted paths