CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Attackers can trigger server-side requests to internal endpoints via Avro schema URLs, potentially exposing sensitive data through error messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54048?
CVE-2026-54048 is a medium-severity server-side request forgery vulnerability in Apache Impala, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-54048?
It affects 1 product.
Products include Apache Impala.
How do I fix CVE-2026-54048?
No fix has been published for CVE-2026-54048 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-54048 being exploited?
There is no known exploitation of CVE-2026-54048 in the wild and no public exploit code.
Other vulnerabilities in Apache Impala
- CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token
- CVE-2018-11792 Privilege escalation in Apache Impala
- CVE-2017-5640 Auth bypass in Apache Impala
- CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF
- CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading
Sources
Also known as GHSA-mjfw-8c8c-xr6h.