CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading

What is CVE-2026-65181?

CVE-2026-65181 is a high-severity code injection vulnerability in Apache Impala, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Weakness: CWE-913

Which versions are affected by CVE-2026-65181?

It affects 1 product.

Products include Apache Impala.

How do I fix CVE-2026-65181?

No fix has been published for CVE-2026-65181 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-65181 being exploited?

There is no known exploitation of CVE-2026-65181 in the wild and no public exploit code.

Other vulnerabilities in Apache Impala

• CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token Critical 9.8
• CVE-2018-11792 Privilege escalation in Apache Impala Critical 9.8
• CVE-2017-5640 Auth bypass in Apache Impala Critical 9.8
• CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF High 8.8
• CVE-2021-28131 Impala logs contain secrets High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fgj6-96xv-8x24.