oss-security - CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <eef0476e-e251-e4f0-bce0-ac259bebe5e0@apache.org>
Date: Tue, 08 Sep 2026 20:57:36 +0000
From: Michael Smith <michaelsmith@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-65181: Apache Impala: RCE via External Data Source Class
 Loading 

Severity: important 

Affected versions:

- Apache Impala 2.7.0 through 4.5.1

Description:

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Credit:

zhaokaifei ChinaTelecom (reporter)

References:

https://impala.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-65181

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.