CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading

Q: What access does an attacker need to exploit this issue?

The attacker needs privileges to upload a file to remote storage and to create a table in Impala. The issue is therefore relevant to clients that have both of these capabilities.

Q: Which deployments are affected?

Apache Impala versions 2.7 through 4.5 are affected. Version 4.5.2 fixes the issue.

Q: What is the impact of successful exploitation?

A permitted client can execute arbitrary Java code by uploading a file to remote storage and creating a Data Source table.

Published Sep 8, 2026

Updated

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Affected Software

1 affected component

Apache Impala>=2.7<=4.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Impala to a version that resolves this vulnerability.
Fixed in 4.5.2

Event History

Sep 9, 2026

CVE Published

via MITRE·10:40 AM

Data Sourced

via MITRE·10:40 AM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs privileges to upload a file to remote storage and to create a table in Impala. The issue is therefore relevant to clients that have both of these capabilities.

Which deployments are affected?