CVE-2026-54048— Apache Impala: Avro Schema URL Server-Side Request Forgery
Quick assessment
Affected
Apache Software Foundation Apache Impala
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Impala 2.0.0 至 4.5.1 的所有平台上，如果用户在表定义中通过 或使用 URI 指定 Avro 模式，攻击者可以触发针对内部端点的 GET 请求。这些端点攻击者可能无法直接访问，但 Impala 可以访问，而响应内容可能会通过解析错误信息暴露出来。 建议用户升级到 4.5.2 版本，该版本修复了此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54048
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Impala: Avro Schema URL Server-Side Request Forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Impala | 2.0.0 ~ 4.5.1 | - |
|
II. Public POCs for CVE-2026-54048
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54048
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-54048 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-09 · 9 CVEs total
| CVE-2026-74761 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscripti | |
| CVE-2026-73334 | Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that sk | |
| CVE-2026-41871 | Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST A | |
| CVE-2026-41869 | Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch | |
| CVE-2026-41870 | Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Serv | |
| CVE-2026-65181 | Apache Impala: RCE via External Data Source Class Loading | |
| CVE-2026-57866 | Apache Impala: Secrets Exfiltration via SSRF | |
| CVE-2026-56207 | Apache Impala: SAML authentication bypass via forged bearer token |
IV. Related Vulnerabilities
Same product: Apache Impala
Same vendor: Apache Software Foundation
-
CVE-2026-74761
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ -
CVE-2026-73334
Apache Parquet Hadoop: File-controlled KMS URL is forwarded -
CVE-2026-41871
Apache Nutch: Unauthenticated reflection-based job execution -
CVE-2026-41869
Apache Nutch: Unauthenticated forced shutdown and job interr -
CVE-2026-41870
Apache Nutch: Unauthenticated remote code execution (RCE) vi
Same weakness: CWE-918
V. Comments for CVE-2026-54048
No comments yet