CVE-2026-57866— Apache Impala: Secrets Exfiltration via SSRF
Quick assessment
Affected
Apache Software Foundation Apache Impala
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Impala 4.4.x 和 4.5.x 版本中存在服务器端请求伪造（SSRF，Server Side Request Forgery）漏洞。拥有执行 函数权限的已认证 Impala 用户可以外泄在 的 属性中配置的凭证提供者所提供的密钥（secrets）。前提条件是：用户必须已知晓该密钥的键名（key）。
Possible ATT&CK Techniques 3 AI
T1056 · Input Capture T1114 · Email Collection T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57866
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Impala: Secrets Exfiltration via SSRF
Source: CVE Program / CVE List V5
Vulnerability Description
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Impala | 4.4.0 ~ 4.5.1 | - |
|
II. Public POCs for CVE-2026-57866
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57866
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-57866 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-09 · 9 CVEs total
| CVE-2026-74761 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscripti | |
| CVE-2026-73334 | Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that sk | |
| CVE-2026-41871 | Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST A | |
| CVE-2026-41869 | Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch | |
| CVE-2026-41870 | Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Serv | |
| CVE-2026-65181 | Apache Impala: RCE via External Data Source Class Loading | |
| CVE-2026-56207 | Apache Impala: SAML authentication bypass via forged bearer token | |
| CVE-2026-54048 | Apache Impala: Avro Schema URL Server-Side Request Forgery |
IV. Related Vulnerabilities
Same product: Apache Impala
Same vendor: Apache Software Foundation
-
CVE-2026-74761
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ -
CVE-2026-73334
Apache Parquet Hadoop: File-controlled KMS URL is forwarded -
CVE-2026-41871
Apache Nutch: Unauthenticated reflection-based job execution -
CVE-2026-41869
Apache Nutch: Unauthenticated forced shutdown and job interr -
CVE-2026-41870
Apache Nutch: Unauthenticated remote code execution (RCE) vi
Same weakness: CWE-918
V. Comments for CVE-2026-57866
No comments yet