CVE-2026-54048CWE-918ssrf

CVE-2026-54048

Medium · published September 9, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.

Users are recommended to upgrade to version 4.5.2, which fixes this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00544 · 44.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-09T15:17Z
Affected products (1)
ProductVersionsFixed in
apache/impala≥ 2.7.0, < 4.5.24.5.2
References (2)
https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c · [email protected]http://www.openwall.com/lists/oss-security/2026/09/08/21 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 11 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 10:34Z
    Apache Impala: Avro Schema URL Server-Side Request Forgery
    cvelistv5