high8.8
CVE-2026-57866
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.
Impact
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Impala | from 4.4.0 through 4.5.2 |