VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Sep 9, 2026· Updated Sep 10, 2026

CVE-2026-54048

CVE-2026-54048

Description

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Impala2 versions
    cpe:2.3:a:apache:impala:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:impala:*:*:*:*:*:*:*:*range: >=2.7.0,<4.5.2
    • (no CPE)range: 2.0.0 to 4.5.1

Patches

Vulnerability mechanics

References

2

News mentions

1