CVE-2026-49845: Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.
Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PARTNAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Hiveto a version that resolves this vulnerability.Fixed in 4.2.1 - Configuration
Disable direct SQL in Hive Metastore by setting metastore.try.direct.sql to false (default is true) to avoid the vulnerable partition-name direct-SQL paths where client-supplied partition names are embedded via string concatenation.
Hive Metastore metastore.try.direct.sql = false
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Apache Hive versions before 4.2.1 are affected when Hive Metastore direct SQL is enabled. The metastore.try.direct.sql setting defaults to true, so deployments using the default configuration are exposed.
What access does an attacker need?
An attacker must be authenticated or otherwise network-trusted and able to invoke affected Hive Metastore RPCs. Exploitation uses crafted partition names supplied in those RPC requests.
What could an attacker affect besides a single requested partition?
A crafted partition name can alter the generated SQL WHERE clause so an operation intended for one partition matches additional metadata rows. Affected actions can include partition reads, statistics updates, truncation targets, file-metadata cache operations, and related metadata operations.
What should be done if immediate remediation is needed?
Upgrade Apache Hive to version 4.2.1, which fixes the issue. Until upgraded, restricting access to Hive Metastore APIs limits exposure to callers able to submit crafted partition-name RPC requests.