CVE-2026-97720CWE-303

CVE-2026-97720

Critical · published October 7, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens.  Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.

Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.2th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-10-07T13:17Z
References (2)
https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/07/22 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 08 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 07 OCT 08:46Z
    Apache Impala: Impala Executor Webserver Auth Bypass
    cvelistv5