CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF
Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext() function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml. The secret's key must be known to the user.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be an authenticated Impala user and have permission to execute the ai_generate_text() function. They must also know the key of the secret they want to retrieve.
What information is exposed if exploitation succeeds?
Secrets supplied by credential providers configured through the hadoop.security.credential.provider.path setting in core-site.xml can be exfiltrated. The available data does not indicate exposure of secrets outside those configured providers.
How can I determine whether my deployment is potentially affected?
Review whether the deployment runs an Apache Impala 4.4.x or 4.5.x version, whether core-site.xml configures hadoop.security.credential.provider.path, and which users can execute ai_generate_text(). A deployment is exposed when a user with that permission can target a secret key known to them.