CVE-2026-52691CWE-89sql-injection

CVE-2026-52691

High · published September 4, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module.

This issue affects Apache Griffin Hive Metastore Module: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-04T18:17Z
References (2)
https://lists.apache.org/thread/ocjolvzl804qlkto2vx685f8o23vxxlo · [email protected]http://www.openwall.com/lists/oss-security/2026/09/04/4 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 04 SEP 13:39Z
    Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module
    cvelistv5