CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Impalato a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Impala versions 2.0.0 through 4.5.1 on all platforms are affected when an attacker can define a table property containing an avro.schema.url value.
What does an attacker need to exploit this issue?
The attacker needs the ability to specify tblproperties with an avro.schema.url using an HTTP URL or a file:/// URI. Impala then makes a GET request using its own network access.
What information could be exposed?
Responses from internal endpoints that the attacker cannot directly access may be exposed through schema parsing error messages.
What should teams do to remediate the issue?
Upgrade Apache Impala to version 4.5.2, which fixes the issue.