CVE-2026-97720criticalCWE-303

CVE-2026-97720: falha crítica em Apache Impala

Apache Impala: Impala Executor Webserver Auth Bypass

Publicada em

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.2%
probabilidade de exploração
0.2%top 91% das CVEs
exploração observada
nãonenhuma fonte reporta
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens.  Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache Impala
CVEs relacionadas — Apache Impala

No mesmo produto, das mais perigosas para as menos.

CVE-2021-28131—Impala logs contain secretsEPSS 3.3%CVE-2017-5640—CVE-2017-5640EPSS 2.9%CVE-2018-11792—CVE-2018-11792EPSS 2.5%CVE-2017-9792—CVE-2017-9792EPSS 1.6%CVE-2018-11785—CVE-2018-11785EPSS 1.2%CVE-2017-5652—CVE-2017-5652EPSS 1.2%
Referências
https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2http://www.openwall.com/lists/oss-security/2026/10/07/22