CVE-2026-54048 — Apache Impala: Avro Schema URL Server-Side Request Forgery

Description (CNA)

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Impala	affected 2.0.0 through 4.5.1

CWE

CWE-918

References

https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/08/21

CISA-ADP

No English description supplied.

No references supplied.