CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF

What is CVE-2026-57866?

CVE-2026-57866 is a high-severity server-side request forgery vulnerability in Apache Impala, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.

Weakness: CWE-918

Which versions are affected by CVE-2026-57866?

It affects 1 product.

Products include Apache Impala.

How do I fix CVE-2026-57866?

No fix has been published for CVE-2026-57866 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-57866 being exploited?

There is no known exploitation of CVE-2026-57866 in the wild and no public exploit code.

Other vulnerabilities in Apache Impala

• CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token Critical 9.8
• CVE-2018-11792 Privilege escalation in Apache Impala Critical 9.8
• CVE-2017-5640 Auth bypass in Apache Impala Critical 9.8
• CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading High 8.1
• CVE-2021-28131 Impala logs contain secrets High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pvq3-8vp3-rhh8.