Critical severity · published Oct 7, 2026
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.
Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Apache Impala · Apache Software Foundation
4.1.0 through 4.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97720
vendor-advisory
https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2
More from Apache Impala
9.8
CVE-2026-56207
Apache Impala: SAML authentication bypass via forged bearer token
8.8
CVE-2026-57866
Apache Impala: Secrets Exfiltration via SSRF
8.1
CVE-2026-65181
Apache Impala: RCE via External Data Source Class Loading
6.5
CVE-2026-90466
Apache Impala: Path traversal executes JARs outside trusted paths
5.4
CVE-2026-93684
Apache Impala: Stored XSS in Impala query plans