CVE-2026-54048
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Scoring
- CVSS base score
- 0
- CWE
- CWE-918
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- Apache Software Foundation Apache Impala
Weakness type
Related vulnerabilities
- CVE-2026-19233 — CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized...
- CVE-2026-86771 — Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
- CVE-2026-87821 — Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
- CVE-2026-79635 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-57866 — Apache Impala: Secrets Exfiltration via SSRF
- CVE-2026-19733 — SSRF in Yordam Informatics's Library Automation System
- CVE-2026-80123 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87084 — Tanium addressed a server-side request forgery vulnerability in Enforce.