IM
Product
Impala
12
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 5Medium 4Low 0
Watch
Add Impala to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56207 | 9.8 | Sep 9 | Apache Impala: SAML authentication bypass via forged bearer token Affected: 4.0.0 before 4.5.2 |
| CVE-2018-11792 | 9.8 | Oct 24 | In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table Affected: before 3.0.1 |
| CVE-2017-5640 | 9.8 | Jul 10 | It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when… Affected: 2.7.0; 2.8.0 |
| CVE-2026-57866 | 8.8 | Sep 9 | Apache Impala: Secrets Exfiltration via SSRF Affected: 4.4.0 through 4.5.2 |
| CVE-2026-65181 | 8.1 | Sep 9 | Apache Impala: RCE via External Data Source Class Loading Affected: 2.7.0 before 4.5.2 |
| CVE-2021-28131 | 7.5 | Jul 22 | Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user Affected: before 4.0.0 |
| CVE-2019-10084 | 7.5 | Nov 5 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a… Affected: 2.7.0 through 3.2.0 |
| CVE-2017-5652 | 7.5 | Jul 10 | During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to… Affected: 2.7.0; 2.8.0 |
| CVE-2026-90466 | 6.5 | Oct 7 | Apache Impala: Path traversal executes JARs outside trusted paths Affected: 4.5.2 |
| CVE-2018-11785 | 6.5 | Oct 24 | Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong… Affected: before 3.0.1 |
| CVE-2017-9792 | 6.5 | Oct 4 | In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to… Affected: 2.8.0; 2.9.0 |
| CVE-2026-54048 | 5.3 | Sep 9 | Apache Impala: Avro Schema URL Server-Side Request Forgery Affected: 2.7.0 before 4.5.2 |
Showing 12