CVE-2026-90466 Apache Impala: Path traversal executes JARs outside trusted paths

Medium 6.5 Published 7 Oct 2026 Updated 7 Oct 2026

Path traversal in Apache Impala allows loading malicious JARs from outside trusted paths, enabling code execution if trusted_jar_paths is configured.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-90466?

CVE-2026-90466 is a medium-severity path traversal vulnerability in Apache Impala, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.

The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin.

Users are recommended to upgrade to version 4.5.3, which fixes this issue.

Weakness: CWE-23

Which versions are affected by CVE-2026-90466?

It affects 1 product.

Products include Apache Impala.

How do I fix CVE-2026-90466?

No fix has been published for CVE-2026-90466 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-90466 being exploited?

There is no known exploitation of CVE-2026-90466 in the wild and no public exploit code.

Sources

Also known as GHSA-xf54-j4ff-f2xp.